CVE-2026-80535 Overview
CVE-2026-80535 is a Linux kernel vulnerability in the XFS filesystem's directory tree repair code. The dirtree scrubber can identify a directory that references itself. When the repair code encounters this self-referential state, it attempts to acquire both iolock and ilock on sc->ip and dp as if they were distinct inodes. Because both pointers reference the same inode, this results in a double-lock condition. The fix detects the self-referential case and handles the locking appropriately.
Critical Impact
A double-lock on a single inode during XFS directory tree repair can lead to kernel deadlock and denial of service on affected systems.
Affected Products
- Linux kernel (XFS filesystem subsystem)
- Distributions shipping affected kernel versions with XFS dirtree scrubber and repair support
- Systems using XFS online repair (xfs_scrub)
Discovery Timeline
- 2026-08-26 - CVE-2026-80535 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80535
Vulnerability Analysis
The XFS filesystem includes an online repair facility that scrubs metadata inconsistencies while the filesystem is mounted. One check, the dirtree scrubber, validates that the directory hierarchy forms a proper tree without cycles. When this check identifies a directory whose parent pointer refers back to itself, the corresponding repair routine executes to correct the corruption.
The repair routine expects to operate on two distinct inodes: the inode being scrubbed (sc->ip) and the parent directory inode (dp). It acquires iolock and ilock on both inodes to serialize access during the repair. In the self-referential corner case, sc->ip and dp point to the same in-memory inode. The unconditional locking sequence therefore attempts to acquire the same lock twice on the same object, producing a double-lock.
The patch introduces a check for this condition and adjusts the locking path so that a single inode is locked only once during self-referential repair. This class of defect maps to concurrency handling errors in kernel locking primitives.
Root Cause
The root cause is missing detection of an aliasing condition between two inode pointers in the XFS directory tree repair code. The repair path assumes sc->ip and dp are distinct, which is not guaranteed when the corruption being repaired is a self-referential directory.
Attack Vector
Triggering the flaw requires an XFS filesystem containing a self-referential directory and invocation of the online repair path (for example, via xfs_scrub). No public exploit is available, and no CISA KEV listing exists. Exploitation would generally require local privileges sufficient to run repair operations or the ability to mount a crafted XFS image.
No verified exploitation code is available. See the upstream kernel commits linked in the references for the fix details.
Detection Methods for CVE-2026-80535
Indicators of Compromise
- Kernel soft-lockup or hung-task warnings referencing XFS repair functions and inode locks
- Repeated xfs_scrub invocations that hang or block indefinitely on directory tree repair
- Kernel log entries indicating XFS dirtree corruption followed by unresponsive processes
Detection Strategies
- Compare running kernel versions against the fixed commits: 17bc347cbdfb, 5fc643fb8659, c575904471570, and ce2a7006ec5e.
- Audit systems that run online XFS repair as part of maintenance workflows and verify patch status.
- Correlate dmesg output for XFS-related lock warnings with process state to identify hung repair tasks.
Monitoring Recommendations
- Monitor /var/log/kern.log and dmesg for XFS assertions, deadlock warnings, or hung_task messages naming XFS repair functions.
- Track long-running or stalled xfs_scrub and xfs_repair processes across the fleet.
- Alert on unexpected kernel task state transitions to D state on hosts that use XFS as the root or data filesystem.
How to Mitigate CVE-2026-80535
Immediate Actions Required
- Apply vendor kernel updates that incorporate the upstream XFS fix commits referenced by this CVE.
- Inventory hosts using XFS with online scrub/repair enabled and prioritize them for patching.
- Avoid running xfs_scrub in repair mode on unpatched kernels where directory tree corruption is suspected.
Patch Information
The fix is delivered via upstream Linux kernel commits 17bc347cbdfb, 5fc643fb8659, c575904471570, and ce2a7006ec5e. Rebuild or install distribution kernel packages that include these commits and reboot affected hosts.
Workarounds
- Disable scheduled xfs_scrub executions on unpatched kernels until updates are applied.
- Restrict local user access on multi-tenant hosts that use XFS to reduce the exposure surface.
- Take affected filesystems offline and run xfs_repair from a known-good rescue environment when directory tree corruption is detected.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
