CVE-2026-80899
Received Received - Intake

EROFS fscache Backend Removal Vulnerability

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a local filesystem and has an kernel-defined caching hierarchy which could be inflexible compared to the fanotify pre-content hooks. Therefore, this feature has been deprecated for almost two years. As EROFS file-backed mounts and fanotify pre-content hooks both upstream for a while and already providing equivalent functionality (erofs-utils has supported fanotify pre-content hooks), let's remove the fscache backend now. The main application of this feature is Nydus [1], and they plan to move to use fanotify pre-content hooks in the near future too. I hope this patch can be merged into Linux 7.2, which is also motivated by newly found implementation issues [2][3] that are not worth investigating given the deprecation and limited development resources. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later: it seems fine since the codebase is isolated by CONFIG_CACHEFILES_ONDEMAND. [1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md [2] https://github.com/dragonflyoss/nydus/pull/1824 [3] https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80899
EUVD
EUVD-2026-71649

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel *
dragonflyoss nydus 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the removal of the fscache backend from the EROFS filesystem in the Linux kernel. The fscache feature was used for image lazy pulling but was deprecated due to unexpected dependencies and inflexible caching. The removal is motivated by implementation issues and the availability of alternative solutions like fanotify pre-content hooks.

Detection Guidance

This vulnerability is related to the Linux kernel's EROFS filesystem and fscache subsystem. Detection involves checking if your system uses EROFS with fscache enabled. Run 'grep EROFS /proc/filesystems' and 'grep CONFIG_CACHEFILES /boot/config-$(uname -r)' to verify configuration. Check active mounts with 'mount | grep erofs' and inspect kernel logs for fscache-related errors using 'dmesg | grep fscache'.

Impact Analysis

This vulnerability may impact users relying on EROFS with fscache for image lazy pulling, such as those using Nydus. The removal could disrupt functionality for these users until they transition to alternative solutions like fanotify pre-content hooks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The CVE describes a removal of the EROFS fscache backend in the Linux kernel, which is a filesystem feature change rather than a security flaw. No data exposure or privacy risks are identified in the provided context.

Mitigation Strategies

Update your Linux kernel to version 7.2 or later to remove the vulnerable fscache backend. If using Nydus, switch to fanotify pre-content hooks as per their migration plans. Disable EROFS fscache mounts by updating mount configurations and removing related kernel modules if present.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart