CVE-2026-80533: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80533 Overview

CVE-2026-80533 is a null pointer dereference vulnerability in the Linux kernel's XFS filesystem. The flaw resides in the xrep_iunlink_walk_ondisk_bucket function, which attempts to walk ragi->sc->sa.agi_bp while rebuilding unlinked inode lists during Allocation Group Inode (AGI) header repair. When the buffer verifier fails, agi_bp can be null, causing the repair path to dereference an invalid pointer. The fix substitutes ragi->agi_bp, which bypasses verifier checks, to ensure the pointer is valid during traversal.

Critical Impact
A null pointer dereference during XFS online repair can trigger a kernel oops and denial of service on systems performing filesystem repair operations.

Affected Products

Linux kernel (upstream)
Distributions shipping affected XFS online repair (xrep) code
Systems with XFS filesystems using the online repair (scrub) functionality

Discovery Timeline

2026-08-26 - CVE-2026-80533 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80533

Vulnerability Analysis

The defect exists in the XFS online repair subsystem, which reconstructs damaged filesystem metadata without unmounting the volume. The xrep_iunlink_walk_ondisk_bucket routine walks the on-disk unlinked inode buckets when repairing the AGI header. The routine reads its AGI buffer pointer from ragi->sc->sa.agi_bp. This field can be null when the AGI buffer verifier rejects the block during initial reads. Walking off a null buffer pointer results in a kernel-mode null pointer dereference [CWE-476].

Root Cause

The repair code assumed sc->sa.agi_bp would always reference a valid buffer once repair reached the unlinked-list walk stage. That assumption breaks when the verifier fails on a corrupted AGI block. In this case, the scrub context clears sc->sa.agi_bp, but the repair context (ragi->agi_bp) still holds the raw buffer pointer, since it skips verifier gating. The patch redirects the walk to use ragi->agi_bp directly.

Attack Vector

Triggering the flaw requires an XFS filesystem with a corrupted AGI header and an invocation of online repair against that allocation group. Local privileged operations that mount crafted images or trigger scrub on damaged volumes can drive the code path. The result is a kernel oops rather than memory corruption, limiting impact to availability. See the upstream fixes at kernel.org commit 1e96a00e, 43b4ecbc, a6cfd0e4, and c36d7f68.

Detection Methods for CVE-2026-80533

Indicators of Compromise

Kernel oops or panic traces referencing xrep_iunlink_walk_ondisk_bucket or nearby XFS repair symbols.
dmesg entries reporting AGI buffer verifier failures immediately preceding a crash.
Unexpected termination of xfs_scrub or online repair processes with kernel-side faults.

Detection Strategies

Correlate kernel crash logs with recent invocations of xfs_scrub, xfs_repair, or automatic online repair services.
Monitor XFS verifier failure counters and repair events across fleets running XFS on Linux.
Audit systems mounting untrusted or externally supplied XFS images.

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl output into a central logging pipeline and alert on XFS repair stack traces.
Track kernel package versions across Linux hosts to identify systems still running unpatched XFS code.
Alert on repeated AGI verifier failures on the same device, which indicate underlying corruption plus repair activity.

How to Mitigate CVE-2026-80533

Immediate Actions Required

Apply the upstream Linux kernel commits that redirect the walk to ragi->agi_bp and reboot affected hosts.
Track and deploy vendor kernel updates from your Linux distribution once they include the referenced fix commits.
Avoid running online XFS repair against filesystems with known AGI corruption on unpatched kernels.

Patch Information

The fix is committed upstream across multiple stable branches. Reference the kernel commits 1e96a00e0d3a, 43b4ecbc948a, a6cfd0e4bb1e, and c36d7f68f1c2. Consult your Linux distribution's advisory feed for backported kernel builds.

Workarounds

Disable automated xfs_scrub timer units (for example, xfs_scrub_all.timer) on unpatched systems until kernel updates are installed.
Take suspected corrupt XFS volumes offline and use xfs_repair from a stable rescue environment instead of online repair.
Restrict privileged mount and scrub operations to trusted administrators to limit exposure of the vulnerable code path.

bash

# Verify kernel version and disable automated online scrub until patched
uname -r
systemctl disable --now xfs_scrub_all.timer
systemctl status xfs_scrub_all.timer