CVE-2026-80805 Overview
CVE-2026-80805 is an out-of-bounds read vulnerability in the Linux kernel's XFS filesystem code. The flaw resides in xfs_attr3_leaf_verify_entry(), which accesses lentry/rentry fields (namelen, valuelen) before validating that the entry pointer itself is within buffer bounds. A crafted nameidx pointing near the end of the buffer causes these field accesses to read out-of-bounds memory before the name_end > buf_end check runs. The upstream fix adds explicit bounds checks for entry pointers and uses offsetof() to confirm that the start of the flexible array member (nameval/name) is within the buffer, ensuring all preceding fields are safe to access.
Critical Impact
A crafted XFS filesystem image or corrupted on-disk metadata can trigger out-of-bounds kernel memory reads during attribute leaf verification, risking kernel information disclosure or denial of service.
Affected Products
- Linux kernel (XFS filesystem subsystem)
- Multiple stable kernel branches referenced by upstream fix commits
- Distributions shipping vulnerable XFS code prior to backports
Discovery Timeline
- 2026-09-04 - CVE-2026-80805 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80805
Vulnerability Analysis
The vulnerability exists in the XFS extended attribute (xattr) leaf verification path. xfs_attr3_leaf_verify_entry() is responsible for validating individual attribute entries stored within a leaf block. Each entry contains a nameidx offset that locates the corresponding xfs_attr_leaf_name_local or xfs_attr_leaf_name_remote structure inside the same buffer.
The function dereferences the resulting lentry or rentry pointer and reads the namelen and valuelen fields before validating that the entry pointer sits within the buffer. When nameidx is crafted to point near the end of the buffer, the field reads occur past buf_end. The subsequent name_end > buf_end bounds check runs too late to prevent the out-of-bounds access. This is a classic out-of-bounds read caused by field access preceding pointer validation.
Root Cause
The root cause is an ordering error in input validation. The verifier trusts an attacker-controlled offset (nameidx) before confirming the derived pointer is within bounds. The fix reorders validation to check that the entry structure — up to and including the flexible array member computed via offsetof(struct ..., nameval) or offsetof(struct ..., name) — lies entirely within the buffer prior to any field dereference.
Attack Vector
Exploitation requires the kernel to parse a maliciously crafted XFS filesystem. Realistic vectors include mounting an attacker-supplied XFS image (for example from removable media, a container image, or a loopback file) or processing on-disk metadata that has been tampered with. Successful triggering yields an out-of-bounds read of adjacent kernel memory, which can produce information disclosure through verifier error paths or a denial of service if the read crosses an unmapped page boundary.
No verified public exploit code is available. The upstream patches referenced in the NVD entry describe the vulnerable code path and the corrective bounds checks.
Detection Methods for CVE-2026-80805
Indicators of Compromise
- Kernel log entries from the XFS subsystem reporting xfs_attr3_leaf_verify or XFS_ERRTAG_ATTR_LEAF verifier failures
- Unexpected mount failures or filesystem shutdowns (Corruption of in-memory data detected) when handling attribute leaf blocks
- KASAN reports referencing xfs_attr3_leaf_verify_entry on instrumented kernels
Detection Strategies
- Inventory running kernel versions across Linux endpoints and servers and compare them against the fixed commits listed in the NVD references
- Alert on mount operations for XFS filesystems originating from removable media, user-writable loopback files, or untrusted container image layers
- Correlate dmesg verifier errors with the user or process that initiated the mount to identify suspicious activity
Monitoring Recommendations
- Forward kernel logs (/var/log/kern.log, journald) to a central analytics platform and index XFS verifier messages
- Monitor mount(2) syscall telemetry for XFS sources not managed by the system administrator
- Track patch compliance for kernel packages across fleets using standard configuration management tooling
How to Mitigate CVE-2026-80805
Immediate Actions Required
- Apply the latest stable kernel updates from your Linux distribution that incorporate the upstream XFS fixes referenced by NVD
- Restrict the ability of unprivileged users to mount arbitrary XFS filesystems, including via loopback devices and user namespaces
- Audit workflows that automatically mount untrusted XFS images, such as forensic tooling or container build pipelines
Patch Information
The fix is delivered across multiple stable branches through the following upstream commits: Kernel Commit 03a1225, Kernel Commit 0f82586, Kernel Commit 134d82a, Kernel Commit 184c1a8, Kernel Commit 98a42bb, Kernel Commit 9f92e74, Kernel Commit b7eea80, Kernel Commit c35da2b, and Kernel Commit e99120b. Consult your distribution's security tracker for the specific package version containing the backport.
Workarounds
- Disable or block automatic mounting of removable media and untrusted disk images until patched kernels are deployed
- Disallow unprivileged user namespaces where mount capabilities are not required for workloads
- Where feasible, run KASAN-instrumented kernels in test environments to detect exploitation attempts against the vulnerable verifier path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
