CVE-2026-80537: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80537 Overview

CVE-2026-80537 is an out-of-bounds write vulnerability in the Linux kernel's XFS filesystem. The flaw resides in the realtime reference-count (rtrefcount) btree root-level validation logic. Both xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount() compare the on-disk root level with > instead of >=, permitting a level equal to m_rtrefc_maxlevels to pass validation. A crafted rtreflink image with a metadir plus realtime plus reflink configuration triggers a slab out-of-bounds write in the xfs_rtrefcountbt_cur cache. Exploitation requires mounting a malicious image or invoking FS_IOC_GETFSMAP against the realtime device.

Critical Impact
A local attacker who can mount a crafted XFS image achieves kernel memory corruption, leading to potential privilege escalation or kernel panic.

Affected Products

Linux kernel builds containing the XFS rtreflink (metadir + realtime + reflink) support
Distributions shipping affected mainline XFS code prior to the fix commits
Systems permitting local users to mount untrusted XFS block devices

Discovery Timeline

2026-08-26 - CVE-2026-80537 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80537

Vulnerability Analysis

The vulnerability is a kernel out-of-bounds write caused by an off-by-one error in on-disk metadata validation. xfs_rtrefcountbt_compute_maxlevels() computes mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1, where the + 1 already accounts for the inode-root level. The deepest valid on-disk root level is therefore m_rtrefc_maxlevels - 1. Cursors must satisfy bc_nlevels <= bc_maxlevels.

Both on-disk validators use > rather than >=, so an rtrefcount inode with bb_level == m_rtrefc_maxlevels passes validation. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1, exceeding bc_maxlevels by one. The xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, so the first btree operation writes to bc_levels[m_rtrefc_maxlevels] past the object boundary.

Root Cause

The root cause is inconsistent comparison operators across sibling verifiers [CWE-193]. The data-device refcount/rmap verifiers and the in-memory rtrmap verifier all use >=, but the rtrefcount paths use >. This inconsistency allows an on-disk level equal to m_rtrefc_maxlevels to be accepted, violating the cursor's fixed-size level array invariant.

Attack Vector

An attacker crafts a malicious XFS filesystem image whose /rtgroups/N.refcount inode carries bb_level == m_rtrefc_maxlevels. The corruption triggers on the first rtrefcount cursor built after mount. Two reachable paths exist: xfs_reflink_recover_cow() during xfs_mountfs() log/CoW recovery, and an FS_IOC_GETFSMAP ioctl targeting the realtime device. KASAN reports a slab-out-of-bounds write of size 2 in xfs_btree_lookup(), followed by a fatal kernel panic. Exploitation requires local access with permission to mount or read from an attacker-controlled block device.

Detection Methods for CVE-2026-80537

Indicators of Compromise

Kernel panic messages referencing xfs_btree_lookup with KASAN slab-out-of-bounds writes into the xfs_rtrefcountbt_cur cache
Mount operations on untrusted XFS images that trigger xfs_reflink_recover_cow faults during xfs_mountfs
FS_IOC_GETFSMAP ioctl calls targeting realtime device metadata immediately preceding a crash

Detection Strategies

Monitor dmesg and kernel audit logs for XFS metadata verifier warnings and unexpected filesystem shutdowns
Alert on mount syscalls initiated by non-root or unprivileged contexts against removable or loop-mounted block devices
Correlate process telemetry showing filesystem ioctls issued shortly after mounting user-supplied images

Monitoring Recommendations

Ingest kernel ring buffer and auditd events into a centralized log platform for retroactive hunting
Track kernel version inventory across Linux hosts to identify systems missing the upstream XFS fix commits
Baseline expected mount sources and flag mounts of ephemeral or user-writable block devices

How to Mitigate CVE-2026-80537

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 8a0ecae2, cc3144da, and ccebfc30 from the stable kernel tree
Restrict mount privileges so untrusted users cannot mount arbitrary block devices or filesystem images
Disable automount for removable media on multi-user hosts until patched kernels are deployed

Patch Information

The fix rejects an on-disk root level equal to m_rtrefc_maxlevels, aligning the rtrefcount verifiers with the >= comparison already used by the data-device refcount/rmap and in-memory rtrmap verifiers. Reference the following stable commits: Kernel commit 8a0ecae2, Kernel commit cc3144da, and Kernel commit ccebfc30.

Workarounds

Prohibit mounting of untrusted XFS images by removing the SUID bit on mount helpers and revoking CAP_SYS_ADMIN from non-administrative users
Disable rtreflink features on hosts that do not require realtime + reflink functionality
Use MAC frameworks such as SELinux or AppArmor to constrain mount and ioctl operations on filesystem devices

bash

# Configuration example: restrict user mounting via udev/polkit
# /etc/polkit-1/rules.d/10-disallow-mount.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.udisks2.filesystem-mount" &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.NO;
    }
});