CVE-2026-80808 Overview
CVE-2026-80808 affects the Linux kernel's ext4 filesystem implementation. The vulnerability resides in ext4_xattr_block_set(), which retries indefinitely when a cache entry selected for reuse has a saturated reference count. A task caught in the retry loop holds the parent directory's i_rwsem, blocking concurrent rmdir callers and producing hung-task reports. Reproduction requires a corrupted filesystem that violates the invariant between reference count and the MBE_REUSABLE_B flag. The syzbot reproducer surfaced allocator and xattr corruption preceding the retry loop. The fix validates the on-disk count before incrementing and clears MBE_REUSABLE_B when saturation is detected.
Critical Impact
A local attacker able to mount or supply a corrupted ext4 image can trigger a kernel hang, leading to denial of service through the blocked directory i_rwsem.
Affected Products
- Linux kernel ext4 filesystem driver
- Multiple stable kernel branches referenced by the fix commits
- Distributions shipping affected upstream kernel versions
Discovery Timeline
- 2026-09-04 - CVE-2026-80808 published to the National Vulnerability Database (NVD)
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80808
Vulnerability Analysis
The defect is a kernel-space infinite loop [CWE-835] in the ext4 extended attribute block reuse path. When ext4_xattr_block_set() looks up a candidate cache entry via mbcache, it takes the buffer lock and inspects the reference count. If the count has reached EXT4_XATTR_REFCOUNT_MAX (1024), the function retries the mbcache lookup. The retry does not mark the offending entry ineligible, so the same saturated entry is selected on every iteration.
Under normal operation, the reference count and the MBE_REUSABLE_B flag are updated under the same buffer lock, so a reusable entry always has count below the maximum. A corrupted filesystem can break this invariant, exposing the retry loop.
Root Cause
The root cause is missing state transition on saturation. The reuse path treats the untrusted on-disk reference count as authoritative and does not defensively clear MBE_REUSABLE_B when the count is already at or above EXT4_XATTR_REFCOUNT_MAX. Combined with the unconditional retry, this produces an unbounded spin. The task holds the parent directory's i_rwsem throughout, so concurrent operations such as rmdir block on the same inode.
Attack Vector
Exploitation requires local access to mount a crafted ext4 image or to reach an already-corrupted filesystem. The syzbot harness reproduced the hang in 6 of 8 420-second QEMU trials, with representative NMI backtraces showing the owner spinning inside ext4_xattr_block_set(). The patched kernel completed 28 of 28 trials without a hung-task report. Refer to the Kernel Git Commit 4902a5c and related commits for the exact code change.
Detection Methods for CVE-2026-80808
Indicators of Compromise
- Repeated hung_task kernel messages naming do_rmdir or other directory operations as the blocked caller.
- NMI backtraces showing a CPU spinning inside ext4_xattr_block_set() or the surrounding mbcache lookup path.
- Sustained high CPU on a kernel thread with the parent directory i_rwsem shown as contended in /proc/*/stack.
Detection Strategies
- Monitor dmesg and journal logs for INFO: task ... blocked for more than messages tied to ext4 operations.
- Correlate soft-lockup or NMI watchdog events with the ext4_xattr_block_set symbol in stack traces.
- Alert on ext4 filesystem corruption events reported by e2fsck or the kernel's own consistency checks.
Monitoring Recommendations
- Enable hung_task_panic or lower hung_task_timeout_secs in test environments to surface the hang quickly.
- Aggregate kernel logs into a centralized SIEM and alert on ext4 xattr symbols appearing in lockup traces.
- Track mount events for untrusted ext4 images, including USB-attached and loopback-mounted filesystems.
How to Mitigate CVE-2026-80808
Immediate Actions Required
- Apply the upstream stable kernel updates referenced in the CVE record as soon as vendor packages are available.
- Restrict local users from mounting arbitrary ext4 images by tightening udev, polkit, and automount policies.
- Run e2fsck on any filesystem suspected of corruption before returning it to production use.
Patch Information
The fix checks the untrusted on-disk reference count before incrementing to avoid overflow, and clears MBE_REUSABLE_B when the count is already saturated. The subsequent mbcache lookup then skips the entry proven unusable. The change mirrors the normal transition at EXT4_XATTR_REFCOUNT_MAX, where the release path re-marks the entry reusable on the exact 1024-to-1023 transition. See the merged commits: Kernel Git Commit 119a2f0, Kernel Git Commit 4902a5c, Kernel Git Commit 54b6bd4, Kernel Git Commit 55ee653, Kernel Git Commit 6163135, Kernel Git Commit 8865cd6, Kernel Git Commit 889ec86, Kernel Git Commit a40c452, and Kernel Git Commit dbd4aea.
Workarounds
- Disable automatic mounting of removable ext4 media where local users could supply crafted images.
- Refuse to mount ext4 filesystems that fail e2fsck consistency checks prior to being brought online.
- Where feasible, avoid workloads that heavily exercise extended attributes on filesystems of unknown provenance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
