CVE-2026-80591 Overview
CVE-2026-80591 is a Linux kernel vulnerability in the Flash-Friendly File System (f2fs) subsystem. The flaw resides in the f2fs_listxattr() function, which fails to validate extended attribute (xattr) entries before reading their fields. When a corrupted xattr entry falls outside the valid xattr storage area, the function returns a successful partial result instead of an error. The upstream fix now returns -EFSCORRUPTED when validation fails.
A local attacker with permission to mount or interact with a crafted f2fs image can trigger out-of-bounds reads in kernel memory, leading to memory corruption, information disclosure, or denial of service.
Critical Impact
Local exploitation of a corrupted f2fs image can produce kernel out-of-bounds reads affecting confidentiality, integrity, and availability of the host system.
Affected Products
- Linux kernel — f2fs filesystem subsystem
- Multiple stable kernel branches receiving backported fixes (see referenced patches)
- Distributions shipping affected kernel versions with f2fs enabled
Discovery Timeline
- 2026-08-28 - CVE-2026-80591 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80591
Vulnerability Analysis
The vulnerability affects the f2fs listxattr implementation in the Linux kernel. Extended attributes are stored in a dedicated on-disk region associated with an inode. When user space calls listxattr() on an f2fs file, the kernel iterates through xattr entries and copies each attribute name into a caller-supplied buffer.
The original implementation trusted the on-disk metadata. It read entry fields such as name length and entry size without confirming that the entry structure fell within the valid xattr storage region. A malformed entry could point beyond the buffer boundary, causing the iterator to read from adjacent kernel memory or loop into attacker-controlled data. This class of defect falls under out-of-bounds read and improper input validation from an untrusted filesystem image.
Root Cause
The root cause is missing bounds validation in f2fs_listxattr() before dereferencing xattr entry fields. The function did not verify that entry and entry + entry_size remained inside the xattr block. Corrupted or maliciously crafted metadata therefore produced undefined reads, and the function silently returned a truncated success rather than surfacing the corruption.
Attack Vector
Exploitation requires local access. An attacker supplies a crafted f2fs image or corrupts xattr metadata on an existing volume, then triggers listxattr() on an affected file. Common delivery paths include removable media containing a malicious f2fs image, container or namespace scenarios permitting filesystem mounts, and Android-style environments where f2fs is widely deployed.
See the upstream commits including Kernel Patch 2770041 and Kernel Patch dfa4891 for the exact validation logic added to f2fs_listxattr().
Detection Methods for CVE-2026-80591
Indicators of Compromise
- Kernel log entries containing EFSCORRUPTED errors originating from the f2fs subsystem after applying the patch.
- Unexpected mounts of f2fs images from user-writable paths, removable media, or container filesystems.
- Processes issuing listxattr or llistxattr syscalls against files on newly mounted or non-standard f2fs volumes.
Detection Strategies
- Audit kernel version inventory across Linux endpoints and servers to identify hosts running unpatched f2fs code.
- Monitor mount syscalls with filesystem type f2fs and correlate with the invoking user, container, or namespace.
- Alert on kernel oops, panic, or KASAN reports referencing f2fs_listxattr or xattr handling paths.
Monitoring Recommendations
- Ingest dmesg and /var/log/kern.log into a centralized log platform and search for f2fs corruption messages.
- Track auditd rules on mount, setxattr, and listxattr syscalls to establish a baseline of legitimate xattr activity.
- Correlate loopback device creation with subsequent f2fs mounts, a pattern commonly used to stage crafted images.
How to Mitigate CVE-2026-80591
Immediate Actions Required
- Apply the latest stable kernel update from your Linux distribution that includes the referenced f2fs backports.
- Restrict which users, containers, and namespaces are permitted to mount arbitrary filesystems, particularly f2fs.
- Disable automatic mounting of removable media on servers and workstations that do not require it.
Patch Information
The fix validates xattr entries in f2fs_listxattr() and returns -EFSCORRUPTED when entries fall outside the valid xattr storage area. Backports are available across stable branches through commits 2770041f, 3c0dbfec, 5ef5bc30, 7dd01f7d, 7dfac47e, c8a10f17, dfa4891c, and ec9f79c8.
Workarounds
- Blacklist the f2fs kernel module on systems that do not require it using /etc/modprobe.d/ configuration.
- Enforce nosuid, nodev, and noexec mount options where f2fs volumes must be mounted from untrusted sources.
- Use kernel lockdown or user-namespace restrictions to prevent unprivileged users from mounting arbitrary filesystem images.
# Configuration example: prevent loading the f2fs module where not needed
echo 'install f2fs /bin/true' | sudo tee /etc/modprobe.d/disable-f2fs.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
