CVE-2026-80536: Linux Kernel XFS Buffer Overflow Vulnerability

CVE-2026-80536 Overview

CVE-2026-80536 is an out-of-bounds write vulnerability in the Linux kernel's XFS filesystem log recovery path. The flaw resides in xlog_recover_do_reg_buffer(), which replays each dirty region described by a buffer log item's bitmap into the buffer read for that item. Both the destination offset and the buffer size are attacker-controlled through the on-disk log, and the only guard is an ASSERT() that compiles away on production kernels.

An attacker who can mount a crafted XFS image triggers a slab-out-of-bounds write during mount-time log recovery, corrupting adjacent kernel heap memory. The issue was found and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build.

Critical Impact
A crafted XFS image can corrupt kernel heap memory during mount, enabling privilege escalation or kernel code execution on systems that mount attacker-supplied filesystems.

Affected Products

Linux kernel with XFS filesystem support enabled
Multiple stable kernel branches (fixes distributed across eight upstream commits)
Any distribution kernel that permits mounting untrusted XFS images

Discovery Timeline

2026-08-26 - CVE-2026-80536 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80536

Vulnerability Analysis

The vulnerability is a heap out-of-bounds write [CWE-787] in the XFS log recovery code path. During mount, xlog_recover_do_reg_buffer() iterates over dirty regions described by a buffer log item's bitmap and copies logged data into the target buffer using memcpy(xfs_buf_offset(bp, (uint)bit << XFS_BLF_SHIFT), item->ri_buf[i].iov_base, nbits << XFS_BLF_SHIFT).

The destination offset derives from bit and nbits fields in the logged bitmap. The buffer size derives from the logged blf_len. Both values originate from the on-disk log and are not cross-validated. Production kernels ship with ASSERT() compiled out, so no runtime bounds check protects the copy.

Exploitation corrupts kernel heap objects adjacent to the XFS buffer allocation. Because this occurs during log recovery at mount time, an attacker with the ability to supply a filesystem image, such as through removable media or a mountable share, controls the shape and contents of the corruption.

Root Cause

The root cause is missing validation between two independent attacker-controlled inputs from the log: the bitmap-driven destination offset and the buffer length. The pre-patch code trusted the ASSERT-based invariant, which does not exist in release builds. This violates the malicious-filesystem threat model that XFS enforces elsewhere.

Attack Vector

The attack requires local access to mount a crafted XFS image. On systems where non-root users can trigger mounts, such as automounters for removable devices, the vulnerability is reachable without privileges. The fix converts the ASSERT() into an XFS_IS_CORRUPT() check that aborts recovery with -EFSCORRUPTED, consistent with the validate-and-fail idiom in xlog_recover_do_inode_buffer() and xfs_dquot_item_recover.c. The function xlog_recover_do_reg_buffer() becomes STATIC int, and its three callers propagate the error.

Detection Methods for CVE-2026-80536

Indicators of Compromise

Kernel oops or KASAN slab-out-of-bounds reports referencing xlog_recover_do_reg_buffer during mount of an XFS filesystem
Unexpected -EFSCORRUPTED errors during XFS mount on patched kernels when untrusted images are attached
Presence of untrusted XFS images on removable media, loopback files, or user-writable mount sources

Detection Strategies

Audit mount syscalls with filesystem type xfs originating from non-administrative users or automount daemons
Monitor kernel ring buffer (dmesg) for XFS log recovery warnings and corruption messages
Inventory hosts running kernels that predate the upstream fix commits (7e32d4e, 813f8136, acb4e262, b7528b42, edaf5b6b, f3859c35, f7b5fa83, f8288214)

Monitoring Recommendations

Alert on kernel panic or heap corruption events correlated with filesystem mount activity
Track process ancestry for mount.xfs invocations tied to USB insertion or network share attachment
Collect and centralize kernel logs to a SIEM for retrospective correlation with mount events

How to Mitigate CVE-2026-80536

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that includes the upstream XFS fix commits
Restrict mounting of XFS filesystems to trusted administrators only
Disable automatic mounting of removable media on multi-user and server systems

Patch Information

The fix converts the ASSERT into a runtime XFS_IS_CORRUPT() check and propagates -EFSCORRUPTED up to callers. Distributed across upstream commits 7e32d4e, 813f8136, acb4e262, b7528b42, edaf5b6b, f3859c35, f7b5fa83, and f8288214.

Workarounds

Block loading of the xfs kernel module on systems that do not require XFS support
Enforce noauto mount options and remove user or users flags from /etc/fstab entries for removable devices
Use udev rules to prevent auto-mount of unknown block devices until the kernel is patched

bash

# Prevent xfs module load on systems that do not need XFS
echo 'install xfs /bin/false' | sudo tee /etc/modprobe.d/disable-xfs.conf
sudo update-initramfs -u