CVE-2026-80805
Received Received - Intake

XFS Filesystem Attribute Validation Flaw

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed. Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80805
EUVD
EUVD-2026-71240

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's XFS file system. It involves improper validation of attribute entry pointers before accessing their fields. Specifically, the function xfs_attr3_leaf_verify_entry() reads fields like namelen and valuelen before checking if the entry pointer itself is within safe bounds. This could allow out-of-bounds memory reads if a crafted nameidx value points near the end of a buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's XFS filesystem. Detection requires checking if your kernel version includes the vulnerable code path. Use uname -a to check your kernel version and compare it against patched versions. Monitor kernel logs for XFS-related errors or crashes that may indicate exploitation attempts.

Impact Analysis

This vulnerability could lead to memory corruption, crashes, or potential privilege escalation if exploited. An attacker with local access might trigger this flaw to read sensitive kernel memory, causing system instability or unauthorized access. Systems using XFS file systems are primarily at risk.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the XFS filesystem module if not in use. Apply kernel patches as soon as they become available from your distribution vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart