CVE-2026-80804 Overview
CVE-2026-80804 is a Linux kernel vulnerability in the XFS filesystem's transaction rolling logic. The flaw resides in xfs_trans_roll(), where the NOFS (no filesystem reclaim) allocation context is cleared before committing a transaction but only restored on the success path. When __xfs_trans_commit() fails, the error path returns without reinstating the NOFS context. This produces a circular lock dependency between xfs_nondir_ilock_class and fs_reclaim, which the kernel lock validator reports as a lockdep violation and which can lead to deadlocks under memory pressure.
Critical Impact
A local workload that triggers XFS transaction commit failures can induce a circular lock dependency, risking kernel deadlock and denial of service on affected systems.
Affected Products
- Linux kernel (XFS filesystem subsystem)
- Distributions shipping vulnerable kernel builds prior to the referenced stable commits
- Systems using XFS as the primary or secondary filesystem
Discovery Timeline
- 2026-09-04 - CVE-2026-80804 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80804
Vulnerability Analysis
The defect lives in the XFS transaction rolling routine xfs_trans_roll(). During a transaction roll, the kernel calls memalloc_nofs_save() to prevent recursive filesystem reclaim while allocating a new transaction. It then invokes __xfs_trans_commit() to finalize the current transaction. On success, xfs_trans_set_context() restores the saved NOFS scope on the new transaction. On failure, the function returns without restoring that context.
Once the NOFS scope is lost, subsequent allocations from a caller still holding an XFS inode lock (xfs_nondir_ilock_class) may re-enter the filesystem via fs_reclaim. Another thread performing reclaim can then acquire the inode lock in the opposite order, creating the classic AB/BA lock inversion documented in the commit message. The kernel's lockdep infrastructure flags this pattern, and under contention it can materialize as a real deadlock.
Root Cause
The root cause is missing unconditional restoration of the NOFS allocation scope after a failed transaction commit. The fix repositions xfs_trans_set_context() before the error check, so the NOFS context is always reapplied to the new transaction regardless of commit outcome. This is a filesystem locking and resource-management defect rather than a memory safety bug.
Attack Vector
The vulnerability requires a local workload capable of triggering __xfs_trans_commit() failures on an XFS mount. It is not remotely reachable and does not yield code execution or privilege escalation. The practical outcome is a deadlock or lockdep splat that can degrade or halt filesystem operations, causing a denial of service. See the upstream fixes in Kernel Git Commit 0241ea5f, Kernel Git Commit 4d00a39c, and Kernel Git Commit b09198cf for the corrected control flow.
Detection Methods for CVE-2026-80804
Indicators of Compromise
- Kernel lockdep warnings referencing xfs_nondir_ilock_class and fs_reclaim in a possible circular locking dependency report.
- Hung task messages or soft lockups tied to XFS transaction paths such as xfs_trans_roll and __xfs_trans_commit.
- Processes stuck in D state waiting on XFS inode locks during heavy memory pressure.
Detection Strategies
- Enable CONFIG_PROVE_LOCKING on test kernels to surface the circular dependency during regression runs.
- Parse dmesg and journald output for lockdep splats containing both xfs_nondir_ilock_class and fs_reclaim.
- Correlate filesystem stalls with kernel version metadata to identify hosts running unpatched XFS code.
Monitoring Recommendations
- Ship kernel logs to a centralized SIEM and alert on lockdep, hung-task, and XFS error signatures.
- Track XFS transaction failure rates and inode lock wait times as operational health metrics.
- Inventory kernel versions across the fleet and flag hosts missing the referenced stable commits.
How to Mitigate CVE-2026-80804
Immediate Actions Required
- Update to a Linux stable kernel that includes commits 0241ea5f, 4d00a39c, or b09198cf applied to your maintained branch.
- Coordinate with distribution vendors to obtain backported packages for long-term support kernels in production.
- Prioritize patching on hosts running XFS with high memory pressure or heavy metadata workloads.
Patch Information
The upstream fix moves xfs_trans_set_context() ahead of the error check in xfs_trans_roll() so that NOFS context is restored unconditionally. Apply the patch from Kernel Git Commit 0241ea5f, or the equivalent stable backports in Kernel Git Commit 4d00a39c and Kernel Git Commit b09198cf. Reboot into the patched kernel after installation.
Workarounds
- Reduce sustained memory pressure on XFS hosts to lower the probability of triggering the lock inversion.
- Where feasible, migrate critical workloads to hosts already running a patched kernel until fleet-wide updates complete.
- Monitor for lockdep and hung-task reports and reboot affected systems promptly to clear stuck XFS transactions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
