CVE-2026-80591

Received Received - Intake

f2fs listxattr Corruption Handling Fix

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80591

EUVD

EUVD-2026-67467

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of corrupted extended attribute (xattr) entries in the F2FS file system. The issue occurs in the f2fs_listxattr function, which fails to validate xattr entries before reading their fields. Instead of returning an error for corrupted entries, it returns a partial successful result.

Detection Guidance

This vulnerability affects the Linux kernel's f2fs file system module. Detection requires checking for corrupted xattr entries in f2fs partitions. Use fsck.f2fs or mount-time checks to identify corruption. No direct network detection is applicable as this is a local file system issue.

Impact Analysis

This vulnerability could allow attackers to access or manipulate file metadata improperly due to incorrect handling of corrupted xattr entries. It may lead to unauthorized data exposure or system instability if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue is specific to the Linux kernel's f2fs file system, where corrupted xattr entries could lead to incorrect handling during listxattr operations. There is no evidence in the provided context that this vulnerability impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80591. Monitor kernel updates from your distribution vendor and apply them promptly.

Hi! I’m here to help you understand CVE-2026-80591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70