CVE-2026-80807: Linux Kernel NILFS2 Privilege Escalation

CVE-2026-80807 is a privilege escalation vulnerability in the Linux kernel NILFS2 filesystem involving invalid block index handling in the GC ioctl that causes list corruption and buffer processing issues. This article covers technical analysis, affected kernel versions, security impact, and available patches.

CVE-2026-80807 Overview

CVE-2026-80807 is a Linux kernel vulnerability in the nilfs2 filesystem. The flaw resides in the garbage collection (GC) ioctl path, where missing range validation on user-supplied nilfs_vdesc fields allows insertion of a page or folio with an index of ULONG_MAX into the page cache. Syzbot fuzzing triggered list corruption through a double list_add_tail() call on bh->b_assoc_buffers inside nilfs_lookup_dirty_data_buffers(). Local users with the ability to invoke the GC ioctl can crash the kernel or corrupt in-kernel data structures. Multiple upstream stable kernel branches received corresponding fixes.

Critical Impact
A local attacker with access to the nilfs2 GC ioctl can trigger kernel list corruption, resulting in denial of service and potential memory safety violations.

Affected Products

Linux kernel nilfs2 filesystem (multiple stable branches)
Distributions shipping vulnerable kernels with nilfs2 enabled
Systems exposing the nilfs2 GC ioctl to unprivileged or semi-privileged users

Discovery Timeline

2026-09-04 - CVE-2026-80807 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80807

Vulnerability Analysis

The nilfs2 filesystem exposes a garbage collection ioctl that moves live blocks during segment cleaning. Before moving a block, the kernel loads its page or folio into the page cache using metadata from a user-supplied nilfs_vdesc structure. The kernel derives the page index from the vd_offset and vd_vblocknr fields without validating their ranges.

When an attacker supplies crafted values, the arithmetic wraps and the resulting page index becomes ULONG_MAX. Subsequent calls to filemap_get_folios_tag() inside nilfs_lookup_dirty_data_buffers() repeatedly return the same dirty folio because the loop cannot advance past the maximum index. This leads to duplicate processing of the same buffer head and a second list_add_tail() on bh->b_assoc_buffers, corrupting the associated buffers list.

Root Cause

The root cause is missing input validation on the vd_offset and vd_vblocknr fields of the nilfs_vdesc structure passed to the GC ioctl. The user-space GC library normally supplies sane values, so out-of-range inputs were not defended against. The kernel patch introduces explicit range checks that reject any nilfs_vdesc producing an invalid page index, preventing the malformed page cache insertion.

Attack Vector

Exploitation requires local access and the ability to issue the nilfs2 GC ioctl against a mounted nilfs2 volume. An attacker crafts a nilfs_vdesc with vd_offset and vd_vblocknr values that cause the computed page index to wrap to ULONG_MAX. Invoking the GC ioctl with this structure triggers the double list_add_tail() and produces kernel list corruption, panic, or exploitable memory state depending on kernel hardening.

No verified public exploit code is available. The vulnerability was discovered through Syzbot kernel fuzzing. See the upstream fix at Kernel Git Commit 3bd064cc for the reference implementation.

Detection Methods for CVE-2026-80807

Indicators of Compromise

Kernel log entries reporting list_add corruption or list_add_tail warnings referencing b_assoc_buffers.
Unexpected kernel panics or BUG: reports originating in nilfs_lookup_dirty_data_buffers() or adjacent nilfs2 code paths.
Unprivileged or unexpected processes invoking ioctl syscalls against nilfs2 mount points.

Detection Strategies

Audit kernel dmesg and journald output for nilfs2-related warnings, list corruption messages, or soft lockups.
Deploy syscall auditing (for example auditd) to log ioctl calls targeting nilfs2 filesystems and correlate with user identity.
Monitor host telemetry for repeated crashes or reboots on systems with nilfs2 mounted.

Monitoring Recommendations

Alert on any process outside expected nilfs2 maintenance tooling issuing GC ioctl requests.
Track kernel version inventory to identify hosts running vulnerable nilfs2 code and prioritize patching.
Forward kernel crash telemetry to a centralized log platform for cross-host correlation of exploitation attempts.

How to Mitigate CVE-2026-80807

Immediate Actions Required

Update the Linux kernel to a stable release containing the nilfs2 range-check patches referenced in the upstream commits.
If patching is not immediately possible, unmount nilfs2 volumes and prevent the nilfs2 module from loading on hosts where the filesystem is not required.
Restrict access to nilfs2 mount points and the GC ioctl to trusted administrative accounts only.

Patch Information

Upstream fixes have been merged across multiple stable branches. Reference commits include Kernel Git Commit 3bd064cc, Kernel Git Commit 68aa9ab6, Kernel Git Commit 898404cd, Kernel Git Commit a1735eae, Kernel Git Commit a5e776e2, Kernel Git Commit ba8a8b56, Kernel Git Commit e447f7ed, Kernel Git Commit ec6ddf27, and Kernel Git Commit fbcfb75c. Apply the vendor-supplied kernel update matching your distribution.

Workarounds

Blacklist the nilfs2 module on systems that do not require the filesystem to eliminate the attack surface entirely.
Enforce strict mount permissions and disallow user-mountable nilfs2 volumes via fstab and udev policy.
Apply kernel hardening options such as panic_on_oops=1 combined with monitoring to detect and contain corruption attempts.

bash

# Prevent the nilfs2 module from loading
echo 'install nilfs2 /bin/true' | sudo tee /etc/modprobe.d/disable-nilfs2.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep nilfs2