CVE-2026-80697 Overview
CVE-2026-80697 is a Linux kernel vulnerability in the Enhanced Read-Only File System (EROFS) subsystem. The flaw stems from backing files used for page cache sharing being initialized with a NULLf_path while only f_inode was populated. A recent mincore fix relies on f_path.mnt, causing a kernel NULL pointer dereference when userspace invokes mincore() against such files. The crash was reproduced by the erofs/028 test on kernel 7.2-rc4, producing an oops at __do_sys_mincore+0xc0/0x2c0. The fix supplies valid disconnected dentries together with erofs_ishare_mnt so that shared backing files behave like real backing files in a pseudo filesystem, allowing standard backing_file_open() to be used directly.
Critical Impact
Local unprivileged users can trigger a kernel NULL pointer dereference through mincore() on EROFS shared-page-cache backing files, resulting in a denial-of-service crash.
Affected Products
- Linux kernel with EROFS page cache sharing enabled
- Linux kernel 7.2-rc4 (confirmed reproducer)
- Distributions shipping the affected EROFS backing-file implementation
Discovery Timeline
- 2026-08-28 - CVE-2026-80697 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80697
Vulnerability Analysis
EROFS supports page cache sharing by attaching backing files that reference an underlying inode. The original implementation created these backing file objects with only f_inode initialized, leaving f_path as NULL. Kernel code paths that previously touched only f_inode operated correctly, so the missing path went undetected.
A subsequent mincore() correctness fix began dereferencing f_path.mnt to resolve the associated mount. When the syscall reached an EROFS shared backing file, the kernel read from offset 0x18 of a NULL pointer and faulted in __do_sys_mincore. The result is a supervisor-mode NULL pointer dereference that panics the affected task and produces a kernel oops.
Root Cause
The root cause is an incomplete struct file initialization inside the EROFS page-cache-sharing setup path [CWE-476: NULL Pointer Dereference]. The code populated f_inode but omitted f_path, violating the invariant that a live struct file visible to VFS syscalls carries a valid path. Once VFS consumers such as mincore() began relying on f_path.mnt, the missing initialization became directly reachable from userspace.
Attack Vector
An unprivileged local user with read access to a file backed by EROFS page cache sharing can invoke mincore() on that mapping. The syscall dereferences f_path.mnt, hits the NULL pointer, and triggers a kernel oops. The condition is deterministic on affected builds and does not require special capabilities. Exploitation for privilege escalation is not indicated in the upstream commit; the observed impact is denial of service through kernel crash.
No public exploit code is required beyond a standard fincore-style tool, which is how the reproducer in the erofs/028 test surfaced the bug. See the upstream fixes: Kernel Patch Commit 3879657c and Kernel Patch Commit 96b2dbbe.
Detection Methods for CVE-2026-80697
Indicators of Compromise
- Kernel oops entries containing BUG: kernel NULL pointer dereference, address: 0000000000000018 with RIP pointing to __do_sys_mincore
- Repeated task crashes in processes calling mincore() or fincore against EROFS-backed files
- Presence of the erofs/028 xfstests failure on affected kernel builds
Detection Strategies
- Parse dmesg and /var/log/kern.log for Oops events referencing __do_sys_mincore on hosts running EROFS with page cache sharing enabled.
- Correlate kernel crash telemetry with process activity to identify local users or containers invoking mincore() on EROFS backing files.
- Track kernel version and EROFS configuration across the fleet to identify hosts running unpatched builds.
Monitoring Recommendations
- Forward kernel ring buffer logs to a centralized logging pipeline and alert on NULL pointer dereference events involving EROFS or mincore.
- Monitor kdump/kexec crash artifacts for stack traces matching the published oops signature.
- Track host availability and unexpected reboots on systems using EROFS-backed container images, where page cache sharing is most commonly deployed.
How to Mitigate CVE-2026-80697
Immediate Actions Required
- Apply the upstream EROFS fixes referenced in the kernel patch commits below and rebuild affected kernels.
- Prioritize patching hosts that use EROFS for container image or read-only filesystem workloads with page cache sharing enabled.
- Restrict untrusted local code execution on affected hosts until the patched kernel is deployed.
Patch Information
The issue is resolved upstream by ensuring valid f_path values using disconnected dentries plus erofs_ishare_mnt, allowing backing_file_open() to construct fully-initialized backing files. Apply the fixes from Kernel Patch Commit 3879657c and Kernel Patch Commit 96b2dbbe, or upgrade to a stable kernel release that includes both commits.
Workarounds
- Disable EROFS page cache sharing where operationally feasible until the patched kernel is deployed.
- Avoid mounting EROFS images with shared-page-cache backing on multi-tenant hosts running untrusted workloads.
- Limit access to tools that call mincore() on EROFS-backed files on unpatched systems.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.