{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80537","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.765Z","datePublished":"2026-08-26T14:37:12.180Z","dateUpdated":"2026-08-27T05:01:27.352Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-27T05:01:27.352Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix off-by-one in rtrefcount btree root level validation\n\nxfs_rtrefcountbt_compute_maxlevels() sets\n\n\tmp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;\n\nwhere the trailing \"+ 1\" already accounts for the inode-root level, so the\ndeepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must\nsatisfy bc_nlevels <= bc_maxlevels (= m_rtrefc_maxlevels).\n\nThe two on-disk validation paths, xfs_rtrefcountbt_verify() and\nxfs_iformat_rtrefcount(), check the root level with \">\" instead of \">=\", so a\ncrafted rtreflink (metadir + realtime + reflink) image whose\n/rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on\nmount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1,\nexceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is\nsized for exactly bc_maxlevels entries, the first btree op on such a cursor\nindexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is\nreached by the first rtrefcount cursor built after mount, via log/CoW\nrecovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an\nFS_IOC_GETFSMAP over the realtime device.\n\nReject a root level equal to m_rtrefc_maxlevels, matching the \">=\" form\nalready used by the sibling data-device refcount/rmap verifiers and the\nin-memory rtrmap verifier.\n\n  BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)\n  Write of size 2 at addr ffff888018391658 by task exploit/144\n   xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)\n   xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308)\n   xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113)\n   xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085)\n   xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551)\n   xfs_mountfs (fs/xfs/xfs_mount.c:1158)\n   xfs_fs_fill_super (fs/xfs/xfs_super.c:1940)\n   get_tree_bdev_flags (fs/super.c:1634)\n   vfs_get_tree (fs/super.c:1694)\n   path_mount (fs/namespace.c:4161)\n   __x64_sys_mount (fs/namespace.c:4367)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216\n  The buggy address is located 8 bytes to the right of\n   allocated 216-byte region [ffff888018391578, ffff888018391650)\n  Kernel panic - not syncing: Fatal exception"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local kernel entry points—mount(2) during xfs_reflink_recover_cow() in xfs_mountfs(), or FS_IOC_GETFSMAP on an already-mounted XFS volume—not via any network-facing protocol handler (NFS/ksmbd/SMB/TCP).\nAC:L - An attacker fully controls the crafted rtreflink image and can set /rtgroups/N.refcount bb_level == m_rtrefc_maxlevels so mount or the first rtrefcount cursor reliably drives xfs_btree_lookup() to write past bc_levels[]; no victim-dependent race or layout luck is required.\nPR:L - Triggering mount of a loop-backed crafted image needs only CAP_SYS_ADMIN inside a user namespace (unshare -Urn), which unprivileged users can obtain on typical systems; FS_IOC_GETFSMAP is additionally reachable with only a readable open file on the mounted filesystem.\nUI:N - In the highest-impact scenario an unprivileged attacker mounts their own malicious XFS image in a user namespace and immediately hits CoW recovery during xfs_mountfs(), with no separate victim action beyond routine local code execution.\nS:U - Exploitation corrupts kernel heap metadata and can panic or compromise the host kernel, but does not cross a CVSS scope boundary such as a VM/hypervisor guest-to-host escape or IOMMU/DMA sandbox breakout.\nC:H - KASAN reports a slab out-of-bounds write in xfs_btree_lookup() past the xfs_rtrefcountbt_cur allocation; such heap corruption can disclose or influence adjacent slab objects and is treated as arbitrary memory-read potential under kernel CVSS guidance.\nI:H - The vulnerability is an out-of-bounds write (2 bytes into bc_levels[m_rtrefc_maxlevels]) on a kmalloc slab cursor object, enabling adjacent-object corruption and further heap shaping toward arbitrary kernel write or code execution.\nA:H - The reported reproducer causes KASAN slab-out-of-bounds followed by kernel panic during mount recovery; any host mounting or querying the malicious rtrefcount metadata can crash or deny service to the entire system."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/xfs/libxfs/xfs_rtrefcount_btree.c"],"versions":[{"version":"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0","lessThan":"8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d","status":"affected","versionType":"git"},{"version":"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0","lessThan":"ccebfc309441e0b37b2e6ece90f18810a489d326","status":"affected","versionType":"git"},{"version":"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0","lessThan":"cc3144da377de5fb422d44a2311f978623f7c900","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/xfs/libxfs/xfs_rtrefcount_btree.c"],"versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","status":"unaffected","versionType":"semver"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.10","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d"},{"url":"https://git.kernel.org/stable/c/ccebfc309441e0b37b2e6ece90f18810a489d326"},{"url":"https://git.kernel.org/stable/c/cc3144da377de5fb422d44a2311f978623f7c900"}],"title":"xfs: fix off-by-one in rtrefcount btree root level validation","x_generator":{"engine":"bippy-1.2.0"}}}}