CVE-2026-80808
Received Received - Intake

ext4 Filesystem Xattr Cache Saturation Vulnerability

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4_xattr_block_set() retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without making that entry ineligible, so it can select the same unusable entry indefinitely. A task spinning there can hold the parent directory's i_rwsem and leave concurrent rmdir callers blocked. Normally a reusable entry has a reference count below EXT4_XATTR_REFCOUNT_MAX because the count and MBE_REUSABLE_B are updated under the same buffer lock. A corrupted filesystem can violate that invariant. The syzbot reproducer reports allocator and xattr corruption before triggering this retry loop. Check the untrusted on-disk count before incrementing it, avoiding overflow, and clear MBE_REUSABLE_B when it is already saturated. The next lookup then skips the entry that was just proven unusable. This mirrors the normal transition at EXT4_XATTR_REFCOUNT_MAX; the release path marks the entry reusable again on the exact 1024-to-1023 transition. Using the same QEMU harness and guest parameters, current unpatched Linux hung in 6 of 8 420-second trials with the do_rmdir signature; representative NMI backtraces caught the owner spinning in ext4_xattr_block_set(). The patched kernel completed 28 of 28 trials without a hung-task report; the final twelve trials exercised the reviewed overflow-safe form of the change. syzbot's patch testing also completed without reproducing the hang.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80808
EUVD
EUVD-2026-71243

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a retry loop in the ext4 filesystem's xattr cache handling. When a cache entry's reference count is saturated, the system keeps retrying the same unusable entry indefinitely, causing tasks to spin and block other operations like rmdir. This happens due to filesystem corruption where the reference count invariant is violated.

Detection Guidance

This vulnerability is specific to the Linux kernel's ext4 filesystem and may not have direct network detection methods. Monitor for system hangs or unresponsive rmdir operations on ext4 filesystems. Check kernel logs for tasks stuck in ext4_xattr_block_set() using commands like 'dmesg | grep ext4' or 'journalctl -k | grep ext4'.

Impact Analysis

This vulnerability can cause system hangs or freezes, particularly when performing directory operations like rmdir. It may lead to unresponsive systems, data corruption, or denial of service if exploited. Users may experience system instability during filesystem operations.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patching is not immediately possible, avoid operations that trigger xattr cache saturation on ext4 filesystems, such as frequent file attribute changes or directory removals.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart