CVE-2026-80899 Overview
CVE-2026-80899 tracks the removal of the deprecated fscache backend from the EROFS (Enhanced Read-Only File System) filesystem in the Linux kernel. The EROFS-over-fscache path was originally added to support image lazy pulling for container workloads such as Nydus. After landing, the fscache subsystem introduced netfs as a hard dependency, which is undesirable for a local filesystem and offers a caching hierarchy less flexible than fanotify pre-content hooks. The feature has been deprecated for nearly two years, and equivalent functionality now exists through EROFS file-backed mounts combined with fanotify pre-content hooks.
Critical Impact
Newly identified implementation issues in the deprecated EROFS fscache backend prompted its complete removal from the kernel rather than further maintenance.
Affected Products
- Linux kernel releases containing the EROFS fscache backend (CONFIG_EROFS_FS_ONDEMAND)
- Nydus image service deployments relying on EROFS-over-fscache lazy pulling
- Container runtimes using fscache-backed EROFS images for on-demand content
Discovery Timeline
- 2026-09-04 - CVE CVE-2026-80899 published to NVD
- 2026-09-07 - Last updated in NVD database
Technical Details for CVE-2026-80899
Vulnerability Analysis
EROFS is a read-only filesystem in the Linux kernel used widely for container images and immutable rootfs deployments. The fscache backend allowed EROFS to fetch image content on demand through the kernel's fscache and cachefiles subsystems, enabling lazy pulling for container image formats such as Nydus.
After the backend landed, fscache adopted netfs as a hard dependency. That pulled network filesystem infrastructure into a local filesystem code path, expanded the attack surface, and locked the caching model into a kernel-defined hierarchy. The Linux maintainers deprecated the feature and steered users toward EROFS file-backed mounts paired with fanotify pre-content hooks, which deliver the same lazy-loading behavior from userspace.
Two recently reported implementation issues in the fscache backend were judged not worth deeper investigation given the deprecation and constrained maintenance resources. The resolution removes the fscache backend from EROFS entirely, with the corresponding fscache/cachefiles cleanup to follow through the netfs (vfs) tree. The isolated CONFIG_CACHEFILES_ONDEMAND guard keeps the follow-on cleanup contained.
Root Cause
The root cause is architectural: the EROFS fscache backend depended on kernel subsystems (fscache and, transitively, netfs) whose evolution introduced unwanted coupling and constrained the caching model. Combined with newly surfaced implementation defects and limited developer bandwidth, continued maintenance was not viable.
Attack Vector
No network-facing attack vector or exploit is described in the advisory. The change is a maintenance-driven removal of a deprecated in-kernel component, motivated by unresolved implementation issues referenced in the upstream discussion. No CVSS vector, CWE mapping, or proof-of-concept has been published for this identifier.
No verified exploitation code is available for CVE-2026-80899. Refer to the upstream commits for the exact scope of the removal: kernel commit c37460cd9b2f and kernel commit f6145794f17a.
Detection Methods for CVE-2026-80899
Indicators of Compromise
- No indicators of compromise have been published for CVE-2026-80899, as the advisory documents a subsystem removal rather than active exploitation.
- Presence of CONFIG_EROFS_FS_ONDEMAND=y in a running kernel indicates the deprecated backend is still compiled in and warrants review.
Detection Strategies
- Inventory kernel builds and container hosts for use of the EROFS fscache backend via zcat /proc/config.gz | grep EROFS_FS_ONDEMAND or equivalent.
- Identify workloads pulling images through Nydus with the fscache driver by inspecting nydusd configuration and mount options.
- Track kernel package versions against distribution advisories that incorporate the upstream removal patch.
Monitoring Recommendations
- Monitor dmesg for EROFS and cachefiles subsystem errors on hosts running affected kernel builds.
- Alert on new mounts referencing the fscache option in EROFS mount syntax so migration progress can be tracked.
- Include kernel configuration drift checks in configuration management to flag reappearance of the deprecated option.
How to Mitigate CVE-2026-80899
Immediate Actions Required
- Upgrade to a Linux kernel release that includes the removal commits referenced in the advisory.
- Migrate Nydus and similar container image workloads from EROFS-over-fscache to EROFS file-backed mounts with fanotify pre-content hooks.
- Audit custom kernel configurations and disable CONFIG_EROFS_FS_ONDEMAND where the backend is no longer required.
Patch Information
The fix removes the EROFS fscache backend in full. Reference the upstream changes at kernel commit c37460cd9b2f and kernel commit f6145794f17a. Distribution kernels will pick up the change through their normal stable update process. The associated fscache/cachefiles cleanup patch is planned to land through the vfs (netfs) tree.
Workarounds
- Rebuild container images using EROFS-utils with fanotify pre-content hook support to preserve lazy pulling behavior.
- Where kernel upgrades are delayed, restrict who can perform EROFS mounts and avoid enabling the on-demand fscache backend on new hosts.
- Track the Nydus project's migration guidance for moving deployments off the fscache driver before removing the backend at scale.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
