CVE-2026-80820: Linux Kernel XFS Filesystem DoS Vulnerability

CVE-2026-80820 Overview

CVE-2026-80820 is a Linux kernel vulnerability in the XFS filesystem online filesystem check (fsck) subsystem. The scrub operation can enter a livelock condition when processing an unlinked inode list that contains a cycle. A tool identified as LOLLM reported that the online fsck implementation lacked cycle detection when traversing the unlinked inode chain. The upstream fix introduces a bitmap to track visited inodes and detect loops during traversal.

Critical Impact
A corrupted or maliciously crafted XFS filesystem containing a circular unlinked inode list can cause the kernel scrub thread to livelock, consuming CPU resources and impacting system availability.

Affected Products

Linux kernel with XFS filesystem online scrub support enabled
Distributions shipping affected upstream kernel versions prior to the referenced stable commits
Systems using xfs_scrub for online filesystem consistency checking

Discovery Timeline

2026-09-04 - CVE-2026-80820 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80820

Vulnerability Analysis

The vulnerability resides in the XFS online filesystem check (scrub) code path that walks the per-allocation-group unlinked inode list. XFS maintains a singly linked list of inodes that have been unlinked but remain open by processes. During scrub, the kernel iterates this list to validate its integrity.

The iteration logic assumed the list was acyclic. When a filesystem contains corruption where an unlinked inode's next-pointer references an inode already visited, the traversal loop never terminates. This produces a livelock: the scrub thread continuously consumes CPU without making progress, degrading system responsiveness.

The fix, applied across stable kernel commits 159d162f, 527eaaef, 56407a61, and 599453f8, introduces a bitmap that records which inodes the scrub has already visited. When the traversal encounters an inode present in the bitmap, it terminates the walk and reports the cycle as filesystem corruption instead of looping indefinitely.

Root Cause

The root cause is missing cycle detection in a linked-list traversal, categorized as an infinite loop condition leading to denial of service. The scrub code trusted on-disk metadata to form a well-terminated list without validating structural invariants during iteration.

Attack Vector

Exploitation requires the ability to mount or trigger online scrub on a crafted XFS image. A local user with permission to mount user-supplied filesystems, or a system that automatically scrubs attached storage, can trigger the livelock. The condition may also arise organically from filesystem corruption caused by underlying storage faults. Refer to the upstream commits linked in the kernel.org stable tree for the exact patch content.

Detection Methods for CVE-2026-80820

Indicators of Compromise

Persistent high CPU utilization attributed to kernel threads associated with xfs_scrub or the XFS scrub worker
System responsiveness degradation immediately following invocation of online scrub on an XFS volume
xfs_scrub processes that fail to terminate within expected time windows

Detection Strategies

Monitor kernel stack traces of long-running scrub threads for repeated calls into the XFS unlinked inode iteration functions
Correlate mount events for removable or user-supplied XFS filesystems with subsequent CPU spikes in kernel context
Review dmesg output for XFS corruption warnings or scrub failure messages preceding hangs

Monitoring Recommendations

Track kernel version inventory across Linux hosts to identify systems missing the stable-tree fix
Alert on xfs_scrub runtime exceeding baseline durations for known-good volumes
Instrument storage attachment workflows to log filesystem type and origin before scrub is initiated

How to Mitigate CVE-2026-80820

Immediate Actions Required

Apply the latest stable Linux kernel update that incorporates commits 159d162f, 527eaaef, 56407a61, or 599453f8 from the upstream XFS tree
Restrict online scrub invocations on XFS volumes originating from untrusted sources until the patch is deployed
Disable automated scheduled xfs_scrub runs on systems that mount user-supplied XFS images

Patch Information

The fix is available in the mainline and stable Linux kernel trees. See Kernel Commit 159d162, Kernel Commit 527eaaef, Kernel Commit 56407a61, and Kernel Commit 599453f8. Distribution vendors typically backport these commits into supported kernel packages.

Workarounds

Avoid running xfs_scrub on XFS filesystems suspected of corruption on unpatched kernels; use offline xfs_repair from a maintenance environment instead
Prevent unprivileged users from mounting arbitrary XFS images by removing SUID mount helpers and tightening /etc/fstabuser options
Isolate workloads that process untrusted filesystem images inside virtual machines or containers with CPU quotas to contain livelock impact

bash

# Verify running kernel includes the fix by checking version and vendor changelog
uname -r
rpm -q --changelog kernel | grep -E '159d162|527eaaef|56407a61|599453f8'
# Debian/Ubuntu
apt changelog linux-image-$(uname -r) | grep -E 'xfs.*scrub|unlinked'