GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80537 (GCVE-0-2026-80537)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
xfs: fix off-by-one in rtrefcount btree root level validation
Summary
In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfs_rtrefcountbt_compute_maxlevels() sets mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1; where the trailing "+ 1" already accounts for the inode-root level, so the deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must satisfy bc_nlevels <= bc_maxlevels (= m_rtrefc_maxlevels). The two on-disk validation paths, xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount(), check the root level with ">" instead of ">=", so a crafted rtreflink (metadir + realtime + reflink) image whose /rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1, exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, the first btree op on such a cursor indexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is reached by the first rtrefcount cursor built after mount, via log/CoW recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an FS_IOC_GETFSMAP over the realtime device. Reject a root level equal to m_rtrefc_maxlevels, matching the ">=" form already used by the sibling data-device refcount/rmap verifiers and the in-memory rtrmap verifier. BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101) Write of size 2 at addr ffff888018391658 by task exploit/144 xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101) xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308) xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113) xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085) xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551) xfs_mountfs (fs/xfs/xfs_mount.c:1158) xfs_fs_fill_super (fs/xfs/xfs_super.c:1940) get_tree_bdev_flags (fs/super.c:1634) vfs_get_tree (fs/super.c:1694) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216 The buggy address is located 8 bytes to the right of allocated 216-byte region [ffff888018391578, ffff888018391650) Kernel panic - not syncing: Fatal exception
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < 8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d (git)
Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < ccebfc309441e0b37b2e6ece90f18810a489d326 (git)
Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < cc3144da377de5fb422d44a2311f978623f7c900 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "ccebfc309441e0b37b2e6ece90f18810a489d326",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "cc3144da377de5fb422d44a2311f978623f7c900",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix off-by-one in rtrefcount btree root level validation\n\nxfs_rtrefcountbt_compute_maxlevels() sets\n\n\tmp-\u003em_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;\n\nwhere the trailing \"+ 1\" already accounts for the inode-root level, so the\ndeepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must\nsatisfy bc_nlevels \u003c= bc_maxlevels (= m_rtrefc_maxlevels).\n\nThe two on-disk validation paths, xfs_rtrefcountbt_verify() and\nxfs_iformat_rtrefcount(), check the root level with \"\u003e\" instead of \"\u003e=\", so a\ncrafted rtreflink (metadir + realtime + reflink) image whose\n/rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on\nmount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1,\nexceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is\nsized for exactly bc_maxlevels entries, the first btree op on such a cursor\nindexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is\nreached by the first rtrefcount cursor built after mount, via log/CoW\nrecovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an\nFS_IOC_GETFSMAP over the realtime device.\n\nReject a root level equal to m_rtrefc_maxlevels, matching the \"\u003e=\" form\nalready used by the sibling data-device refcount/rmap verifiers and the\nin-memory rtrmap verifier.\n\n  BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)\n  Write of size 2 at addr ffff888018391658 by task exploit/144\n   xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)\n   xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308)\n   xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113)\n   xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085)\n   xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551)\n   xfs_mountfs (fs/xfs/xfs_mount.c:1158)\n   xfs_fs_fill_super (fs/xfs/xfs_super.c:1940)\n   get_tree_bdev_flags (fs/super.c:1634)\n   vfs_get_tree (fs/super.c:1694)\n   path_mount (fs/namespace.c:4161)\n   __x64_sys_mount (fs/namespace.c:4367)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216\n  The buggy address is located 8 bytes to the right of\n   allocated 216-byte region [ffff888018391578, ffff888018391650)\n  Kernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local kernel entry points\u2014mount(2) during xfs_reflink_recover_cow() in xfs_mountfs(), or FS_IOC_GETFSMAP on an already-mounted XFS volume\u2014not via any network-facing protocol handler (NFS/ksmbd/SMB/TCP).\nAC:L - An attacker fully controls the crafted rtreflink image and can set /rtgroups/N.refcount bb_level == m_rtrefc_maxlevels so mount or the first rtrefcount cursor reliably drives xfs_btree_lookup() to write past bc_levels[]; no victim-dependent race or layout luck is required.\nPR:L - Triggering mount of a loop-backed crafted image needs only CAP_SYS_ADMIN inside a user namespace (unshare -Urn), which unprivileged users can obtain on typical systems; FS_IOC_GETFSMAP is additionally reachable with only a readable open file on the mounted filesystem.\nUI:N - In the highest-impact scenario an unprivileged attacker mounts their own malicious XFS image in a user namespace and immediately hits CoW recovery during xfs_mountfs(), with no separate victim action beyond routine local code execution.\nS:U - Exploitation corrupts kernel heap metadata and can panic or compromise the host kernel, but does not cross a CVSS scope boundary such as a VM/hypervisor guest-to-host escape or IOMMU/DMA sandbox breakout.\nC:H - KASAN reports a slab out-of-bounds write in xfs_btree_lookup() past the xfs_rtrefcountbt_cur allocation; such heap corruption can disclose or influence adjacent slab objects and is treated as arbitrary memory-read potential under kernel CVSS guidance.\nI:H - The vulnerability is an out-of-bounds write (2 bytes into bc_levels[m_rtrefc_maxlevels]) on a kmalloc slab cursor object, enabling adjacent-object corruption and further heap shaping toward arbitrary kernel write or code execution.\nA:H - The reported reproducer causes KASAN slab-out-of-bounds followed by kernel panic during mount recovery; any host mounting or querying the malicious rtrefcount metadata can crash or deny service to the entire system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:27.352Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccebfc309441e0b37b2e6ece90f18810a489d326"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc3144da377de5fb422d44a2311f978623f7c900"
        }
      ],
      "title": "xfs: fix off-by-one in rtrefcount btree root level validation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80537",
    "datePublished": "2026-08-26T14:37:12.180Z",
    "dateReserved": "2026-08-26T14:34:25.765Z",
    "dateUpdated": "2026-08-27T05:01:27.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80537",
      "date": "2026-09-16",
      "epss": "0.00127",
      "percentile": "0.02715"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80537\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:07.890\",\"lastModified\":\"2026-08-27T06:17:34.210\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxfs: fix off-by-one in rtrefcount btree root level validation\\n\\nxfs_rtrefcountbt_compute_maxlevels() sets\\n\\n\\tmp-\u003em_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;\\n\\nwhere the trailing \\\"+ 1\\\" already accounts for the inode-root level, so the\\ndeepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must\\nsatisfy bc_nlevels \u003c= bc_maxlevels (= m_rtrefc_maxlevels).\\n\\nThe two on-disk validation paths, xfs_rtrefcountbt_verify() and\\nxfs_iformat_rtrefcount(), check the root level with \\\"\u003e\\\" instead of \\\"\u003e=\\\", so a\\ncrafted rtreflink (metadir + realtime + reflink) image whose\\n/rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on\\nmount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1,\\nexceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is\\nsized for exactly bc_maxlevels entries, the first btree op on such a cursor\\nindexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is\\nreached by the first rtrefcount cursor built after mount, via log/CoW\\nrecovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an\\nFS_IOC_GETFSMAP over the realtime device.\\n\\nReject a root level equal to m_rtrefc_maxlevels, matching the \\\"\u003e=\\\" form\\nalready used by the sibling data-device refcount/rmap verifiers and the\\nin-memory rtrmap verifier.\\n\\n  BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)\\n  Write of size 2 at addr ffff888018391658 by task exploit/144\\n   xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)\\n   xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308)\\n   xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113)\\n   xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085)\\n   xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551)\\n   xfs_mountfs (fs/xfs/xfs_mount.c:1158)\\n   xfs_fs_fill_super (fs/xfs/xfs_super.c:1940)\\n   get_tree_bdev_flags (fs/super.c:1634)\\n   vfs_get_tree (fs/super.c:1694)\\n   path_mount (fs/namespace.c:4161)\\n   __x64_sys_mount (fs/namespace.c:4367)\\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\\n  The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216\\n  The buggy address is located 8 bytes to the right of\\n   allocated 216-byte region [ffff888018391578, ffff888018391650)\\n  Kernel panic - not syncing: Fatal exception\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/xfs/libxfs/xfs_rtrefcount_btree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0\",\"lessThan\":\"8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0\",\"lessThan\":\"ccebfc309441e0b37b2e6ece90f18810a489d326\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0\",\"lessThan\":\"cc3144da377de5fb422d44a2311f978623f7c900\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/xfs/libxfs/xfs_rtrefcount_btree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc3144da377de5fb422d44a2311f978623f7c900\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ccebfc309441e0b37b2e6ece90f18810a489d326\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T06:34:04+00:00",
      "cve": "CVE-2026-80537",
      "id": "CVE-2026-80537",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfs: fix off-by-one in rtrefcount btree root level validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80537.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T00:50:25Z",
      "cve": "CVE-2026-80537",
      "id": "CVE-2026-80537",
      "initial_release_date": "2026-08-27T00:12:21Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80537",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80537.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.