CVE-2026-80538: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80538 Overview

CVE-2026-80538 is a Linux kernel vulnerability in the XFS filesystem's realtime group inode handling. The function xfs_rtginode_ensure() incorrectly treats every error from xfs_rtginode_load() other than -ENOENT as success. This flawed error handling leaves the realtime group inode unset after an I/O, allocation, or corruption error, while growfs continues operation as though the inode had been loaded successfully. The result is filesystem integrity and availability impact on affected systems.

Critical Impact
A local authenticated user triggering a growfs operation on a realtime XFS filesystem can cause filesystem corruption or denial of service when transient errors occur during inode loading.

Affected Products

Linux kernel with XFS realtime group support
Distributions shipping affected kernel versions prior to the patch commits
Systems using XFS filesystems with realtime group inodes enabled

Discovery Timeline

2026-08-26 - CVE-2026-80538 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80538

Vulnerability Analysis

The defect resides in the XFS realtime group inode subsystem of the Linux kernel. The function xfs_rtginode_ensure() is responsible for ensuring a realtime group inode is available for filesystem operations such as growfs. It calls xfs_rtginode_load() to load the inode from disk. The caller only distinguishes between the -ENOENT return code, which signals that the inode must be created, and all other outcomes, which it treats as success. This conflates genuine load failures with the loaded state.

When xfs_rtginode_load() returns errors such as -EIO from disk I/O failures, -ENOMEM from allocation failures, or -EFSCORRUPTED from on-disk corruption, the caller ignores them. Subsequent growfs logic then operates on an unset inode reference, leading to inconsistent metadata updates and filesystem state corruption.

Root Cause

The root cause is improper error handling in xfs_rtginode_ensure(). The function narrows its error interpretation to a single sentinel value (-ENOENT) instead of propagating all non-zero errors to the caller. The fix returns every error other than -ENOENT to the growfs caller so that the operation aborts safely.

Attack Vector

Exploitation requires local access with permission to invoke growfs on an XFS filesystem configured with realtime groups. An attacker or unprivileged trigger that induces transient I/O errors, memory pressure, or exploits an already-corrupted realtime metadata structure can force the vulnerable code path. The consequence is high impact to integrity and availability of the filesystem, with no confidentiality exposure.

No public proof-of-concept exploit is available. Technical details are documented in the upstream commits: Kernel Git Commit 61c5165f, Kernel Git Commit b7e53968, and Kernel Git Commit ec19cea4.

Detection Methods for CVE-2026-80538

Indicators of Compromise

Unexpected XFS filesystem errors or XFS_CORRUPTION_ERROR entries in dmesg following a growfs operation on a realtime-enabled filesystem.
growfs_rt operations that report success while kernel logs contain preceding -EIO, -ENOMEM, or -EFSCORRUPTED messages from XFS.
Filesystem metadata inconsistencies detected by xfs_repair after resize operations.

Detection Strategies

Audit kernel logs for XFS realtime group inode load failures correlated with xfs_growfs invocations.
Track xfs_growfs_rt command execution in shell and audit logs, cross-referencing with subsequent filesystem error events.
Monitor for kernel version strings that predate the fix commits on systems using XFS realtime groups.

Monitoring Recommendations

Enable Linux audit rules on execve for xfs_growfs and related XFS administration binaries to establish baseline usage.
Ship kernel ring buffer (dmesg) and journalctl -k output to a centralized log store for pattern analysis of XFS error strings.
Alert on any post-resize xfs_repair findings in maintenance windows to catch silent corruption early.

How to Mitigate CVE-2026-80538

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix commits referenced in the advisory.
Restrict access to XFS administration tools so only trusted operators can invoke xfs_growfs on realtime filesystems.
Back up realtime XFS filesystems before performing resize operations until the patched kernel is deployed.

Patch Information

The fix modifies xfs_rtginode_ensure() to propagate all errors returned by xfs_rtginode_load() except -ENOENT back to the growfs caller. Apply the patched kernel from your distribution vendor or rebuild from the upstream commits: 61c5165f02deb2eed9b6b539bb279e6629fee652, b7e53968cb8882c2d276429ea8550848a4940874, and ec19cea4ef1ce9d6e2e3f7e9e7bf88ede31176e7.

Workarounds

Avoid running xfs_growfs on XFS filesystems configured with realtime groups until the kernel is patched.
Ensure underlying storage is healthy and free of I/O errors before any resize operation to reduce the chance of triggering the flawed error path.
Use file capabilities or sudo policies to limit which accounts can execute XFS resize commands.

bash

# Verify running kernel version and XFS realtime configuration
uname -r
xfs_info /mount/point | grep -i realtime

# Restrict xfs_growfs execution to root-only via sudoers
# In /etc/sudoers.d/xfs-admin:
# %xfsadmins ALL=(root) /usr/sbin/xfs_growfs