CVE-2026-80534 Overview
CVE-2026-80534 is a resource management flaw in the Linux kernel's XFS filesystem quota subsystem. The function xfs_dq_get_next_id() acquires the quota inode ILOCK before calling xfs_iread_extents(). When xfs_iread_extents() fails, the function returns immediately without releasing the lock. This leaves the quota inode locked and causes subsequent quota operations to hang. The upstream fix redirects the error path to a common unlock label so the lock is always released.
Critical Impact
An error path in XFS quota handling leaks the inode ILOCK, causing subsequent quota operations to hang and resulting in a filesystem-level denial of service.
Affected Products
- Linux kernel — XFS filesystem quota code (fs/xfs/xfs_dquot.c)
- Stable branches referenced by the fix commits 0865e4f, 08bed2b, 514a5d4, 63320a0, 6401b99, e270d53, e4c05eb, and ed8bfb4
- Systems mounting XFS volumes with quotas enabled
Discovery Timeline
- 2026-08-26 - CVE-2026-80534 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80534
Vulnerability Analysis
The defect resides in xfs_dq_get_next_id(), an XFS helper that locates the next quota identifier by walking the quota inode's extent map. The function takes the quota inode ILOCK in exclusive or shared mode and then calls xfs_iread_extents() to ensure the extent list is loaded in memory. When xfs_iread_extents() returns a non-zero error, the original code returns directly to the caller and skips the unlock step. The inode lock therefore remains held indefinitely.
Any later thread attempting to acquire the same quota inode ILOCK blocks. This includes routine quotactl(2) operations, quota accounting during allocations, and filesystem shutdown paths that must serialize on the quota inode.
Root Cause
The root cause is an incorrect error-handling flow that violates the lock/unlock pairing invariant. The function uses an early return on failure rather than jumping to a common cleanup label. The patch introduces a goto to a shared unlock path so xfs_iunlock() executes on every exit, regardless of whether xfs_iread_extents() succeeded.
Attack Vector
Triggering the leak requires xfs_iread_extents() to fail during a quota lookup. Failure modes include memory pressure, I/O errors on the quota inode's metadata blocks, or corrupted on-disk extent records. A local user with permission to invoke quota operations on an XFS filesystem experiencing such conditions can induce the hang. Remote exploitation is not applicable; this is a local, availability-impacting bug.
The vulnerability mechanism is described in the upstream commit messages. See the Kernel Git Commit 0865e4f for the fix and additional stable-branch backports listed in the references.
Detection Methods for CVE-2026-80534
Indicators of Compromise
- Processes stuck in uninterruptible sleep (D state) with stack traces referencing xfs_dq_get_next_id, xfs_qm_dqget_next, or xfs_iunlock.
- quotactl or repquota commands hanging indefinitely on an otherwise healthy XFS mount.
- Kernel hung_task warnings naming the XFS quota inode.
Detection Strategies
- Compare running kernel versions against fixed builds referenced by commits 0865e4f, 08bed2b, 514a5d4, 63320a0, 6401b99, e270d53, e4c05eb, and ed8bfb4.
- Monitor /proc/<pid>/stack for tasks blocked on XFS quota inode locks.
- Enable CONFIG_DETECT_HUNG_TASK and alert on hung-task splats mentioning XFS quota functions.
Monitoring Recommendations
- Ship kernel ring buffer output (dmesg, journalctl -k) to a central log store and alert on INFO: task ... blocked for more than messages tied to XFS.
- Track XFS filesystem health metrics, particularly stalled quota subsystem calls and elevated I/O errors against quota metadata.
- Baseline quota tooling latency and alert on outliers that may indicate a leaked ILOCK.
How to Mitigate CVE-2026-80534
Immediate Actions Required
- Inventory hosts running XFS with quotas (uquota, gquota, or pquota mount options) and prioritize them for patching.
- Apply the vendor kernel update that includes one of the referenced stable commits.
- Reboot patched hosts to load the corrected kernel and clear any currently-held stale ILOCK state.
Patch Information
The upstream fix replaces the direct return on xfs_iread_extents() failure with a jump to a common unlock path in xfs_dq_get_next_id(). Distribution kernels should be updated to a release that incorporates one of the following commits: 0865e4f, 08bed2b, 514a5d4, 63320a0, 6401b99, e270d53, e4c05eb, or ed8bfb4.
Workarounds
- Where quotas are not required, remount XFS filesystems without uquota, gquota, or pquota to avoid exercising the vulnerable code path.
- Reduce the likelihood of xfs_iread_extents() failure by resolving underlying storage I/O errors and easing memory pressure on affected hosts.
- Restrict local access to systems until kernels are patched, since the flaw requires local quota activity to trigger.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
