CVE-2026-80806: Linux Kernel ext4 Information Disclosure

CVE-2026-80806 Overview

CVE-2026-80806 is a Linux kernel vulnerability in the ext4 filesystem that causes encryption to be bypassed on newly created files when the filesystem is mounted with -o dax=always. The flaw stems from an ordering bug in __ext4_new_inode(), where ext4_set_inode_flags(inode, init=true) is called before the EXT4_INODE_ENCRYPT flag is set. This allows the kernel to set S_DAX on files that should be encrypted, letting subsequent writes bypass the encryption layer entirely. The issue was introduced by commit 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load"), which broke the previous logic that cleared S_DAX when encryption was enabled.

Critical Impact
Data written to newly created encrypted files on ext4 filesystems mounted with dax=always can bypass encryption, defeating at-rest data confidentiality guarantees.

Affected Products

Linux kernel versions containing commit 043546e46dc7 with ext4 encryption and DAX support
Systems using ext4 filesystems mounted with the -o dax=always option
Environments relying on ext4 per-file encryption (fscrypt) on DAX-capable storage such as persistent memory

Discovery Timeline

2026-09-04 - CVE-2026-80806 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80806

Vulnerability Analysis

The vulnerability resides in the ext4 inode creation path. When a new encrypted regular file is created, __ext4_new_inode() invokes ext4_set_inode_flags(inode, init=true) before the EXT4_INODE_ENCRYPT flag has been applied to the inode. Because encryption state is not yet recorded, the flag-setting routine evaluates the filesystem mount options and sets the S_DAX inode flag when dax=always is in effect.

The EXT4_INODE_ENCRYPT flag is set later in the same function through fscrypt_set_context(), which calls ext4_set_context(). That function then invokes ext4_set_inode_flags(inode, init=false) to apply S_ENCRYPTED. This second call was intended to clear S_DAX as well, but commit 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load") restricted S_DAX modification to inode load events, leaving the stale S_DAX flag in place. As a result, the file ends up with both S_ENCRYPTED and S_DAX set, and DAX write paths bypass the encryption layer. Testing with xfstests generic/548 confirms the failure when dax=always is used.

Root Cause

The root cause is an initialization ordering defect combined with a regression from commit 043546e46dc7. The S_DAX flag is assigned based on mount options before encryption state is recorded, and the later code path that should have reconciled the two flags no longer clears S_DAX.

Attack Vector

Exploitation requires local access to a system where an ext4 filesystem is mounted with dax=always and per-file encryption is in use. Any process able to create files under an encrypted directory on such a mount will produce files whose contents are written to persistent storage in plaintext, defeating the confidentiality expectations of fscrypt.

No verified exploitation code is available. Refer to the upstream commits linked in the Linux Kernel Commit Security Fix and related patches for the authoritative technical details.

Detection Methods for CVE-2026-80806

Indicators of Compromise

Files residing under an ext4 encrypted directory that also carry the S_DAX inode flag, observable via lsattr showing the x attribute on encrypted inodes.
Mount table entries showing ext4 filesystems mounted with dax=always on hosts that also enable fscrypt policies.
xfstests generic/548 failures on affected kernels using dax=always.

Detection Strategies

Enumerate ext4 mounts and flag any combination of dax=always with directories protected by fscrypt policies (fscrypt status, /proc/mounts).
Audit newly created files under encrypted directories for the presence of the DAX attribute using lsattr and compare against expected encryption state.
Track kernel package versions across the fleet and flag hosts running kernels that include commit 043546e46dc7 but lack the fix commits referenced by this CVE.

Monitoring Recommendations

Alert on mount events that combine ext4, encryption policies, and dax=always in configuration management or endpoint telemetry.
Include kernel version and mount option inventory in scheduled compliance scans of storage hosts, particularly those using persistent memory.
Correlate filesystem configuration changes with subsequent file creation activity in encrypted directories to identify potential exposure windows.

How to Mitigate CVE-2026-80806

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fixes referenced in the Linux Kernel Commit Security Fix.
Identify all hosts using ext4 with both fscrypt and dax=always, and treat files created on those hosts before patching as potentially unencrypted at rest.
Rotate encryption keys and rewrite affected files after patching to ensure new content is stored ciphertext-only.

Patch Information

The fix reorders __ext4_new_inode() so that EXT4_INODE_ENCRYPT is set before ext4_set_inode_flags(inode, init=true) is called, ensuring S_DAX is never applied to encrypted inodes. It similarly prevents EXT4_STATE_MAY_INLINE_DATA from being set on new encrypted inodes and removes redundant flag manipulation in ext4_set_context() when handle != NULL. See the upstream patches: Linux Kernel Commit Changes, Linux Kernel Commit Fixes, Linux Kernel Commit Updates, Linux Kernel Commit Refactoring, Linux Kernel Commit Enhancements, Linux Kernel Commit Bug Fixes, Linux Kernel Commit Performance Update, and Linux Kernel Commit Miscellaneous Changes.

Workarounds

Remount affected ext4 filesystems without dax=always, using dax=never or dax=inode where DAX is not required for encrypted data.
Avoid creating new encrypted files on ext4 mounts configured with dax=always until the kernel is patched.
Where persistent memory acceleration is required, host encrypted workloads on a separate filesystem that does not combine DAX with fscrypt.

bash

# Configuration example: identify and remediate at-risk mounts
# 1. List ext4 mounts using dax=always
grep -E 'ext4.*dax=always' /proc/mounts

# 2. Remount without DAX (adjust mount point as needed)
mount -o remount,dax=never /mnt/encrypted

# 3. Verify current kernel version
uname -r