GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80538 (GCVE-0-2026-80538)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
xfs: propagate errors from xfs_rtginode_load
Summary
In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfs_rtginode_load xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs then continues as though the inode had been loaded. Only -ENOENT means that the inode needs to be created. Return all other errors to the growfs caller.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ae897e0bed0f5461a6b1c3259c7d899759ba2a62 , < ec19cea4ef1ce9d6e2e3f7e9e7bf88ede31176e7 (git)
Affected: ae897e0bed0f5461a6b1c3259c7d899759ba2a62 , < 61c5165f02deb2eed9b6b539bb279e6629fee652 (git)
Affected: ae897e0bed0f5461a6b1c3259c7d899759ba2a62 , < b7e53968cb8882c2d276429ea8550848a4940874 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_rtalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ec19cea4ef1ce9d6e2e3f7e9e7bf88ede31176e7",
              "status": "affected",
              "version": "ae897e0bed0f5461a6b1c3259c7d899759ba2a62",
              "versionType": "git"
            },
            {
              "lessThan": "61c5165f02deb2eed9b6b539bb279e6629fee652",
              "status": "affected",
              "version": "ae897e0bed0f5461a6b1c3259c7d899759ba2a62",
              "versionType": "git"
            },
            {
              "lessThan": "b7e53968cb8882c2d276429ea8550848a4940874",
              "status": "affected",
              "version": "ae897e0bed0f5461a6b1c3259c7d899759ba2a62",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_rtalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: propagate errors from xfs_rtginode_load\n\nxfs_rtginode_ensure() treats every xfs_rtginode_load() error other than\n-ENOENT as success.  This can leave the realtime group inode unset after an\nI/O, allocation, or corruption error.  Growfs then continues as though the\ninode had been loaded.\n\nOnly -ENOENT means that the inode needs to be created.  Return all other\nerrors to the growfs caller."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local XFS_IOC_FSGROWFSRT ioctl (xfs_file_ioctl -\u003e xfs_growfs_rt -\u003e xfs_growfs_rtg -\u003e xfs_rtginode_ensure); it is not exposed via NFS, ksmbd, or any network packet handler.\nAC:L - A growfs caller can reliably force xfs_rtginode_load() to return a non-ENOENT error using attacker-influenced conditions such as memory pressure, RT device/metadata I/O faults, or corrupted rtgroup inode state, deterministically entering the swallowed-error path.\nPR:L - xfs_growfs_rt() gates on capable(CAP_SYS_ADMIN), which is satisfied by user-namespace root per kernel CNA guidance; only a writable file descriptor on a realtime-enabled XFS mount is additionally required, not init-namespace root.\nUI:N - The attacker with the required capability and mount write access issues XFS_IOC_FSGROWFSRT directly; no separate victim action such as opening files or mounting the filesystem is needed beyond that.\nS:U - Impact is a host kernel crash or on-disk XFS realtime metadata corruption within the same kernel security domain; it does not cross a VM, container, or IOMMU isolation boundary.\nC:N - The failure mode is an unset rtgroup inode pointer followed by NULL xfs_inode dereference during growfs; there is no use-after-free, out-of-bounds read, or other kernel memory disclosure primitive.\nI:H - Continuing growfs after rtgroup inode load failures lets superblock and realtime bitmap/summary update paths proceed while critical metadata inodes were never loaded, corrupting on-disk XFS realtime metadata integrity (notably on zoned growfs paths that can commit before crashing).\nA:H - When growfs proceeds with NULL rtgroup bitmap or summary inodes, xfs_growfs_rt_bmblock and xfs_rtfile_initialize_blocks dereference the missing xfs_inode and trigger a kernel oops or panic, denying system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:28.422Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ec19cea4ef1ce9d6e2e3f7e9e7bf88ede31176e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/61c5165f02deb2eed9b6b539bb279e6629fee652"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7e53968cb8882c2d276429ea8550848a4940874"
        }
      ],
      "title": "xfs: propagate errors from xfs_rtginode_load",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80538",
    "datePublished": "2026-08-26T14:37:12.767Z",
    "dateReserved": "2026-08-26T14:34:25.765Z",
    "dateUpdated": "2026-08-27T05:01:28.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80538",
      "date": "2026-09-17",
      "epss": "0.00124",
      "percentile": "0.02463"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80538\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:08.017\",\"lastModified\":\"2026-08-27T06:17:34.550\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxfs: propagate errors from xfs_rtginode_load\\n\\nxfs_rtginode_ensure() treats every xfs_rtginode_load() error other than\\n-ENOENT as success.  This can leave the realtime group inode unset after an\\nI/O, allocation, or corruption error.  Growfs then continues as though the\\ninode had been loaded.\\n\\nOnly -ENOENT means that the inode needs to be created.  Return all other\\nerrors to the growfs caller.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/xfs/xfs_rtalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ae897e0bed0f5461a6b1c3259c7d899759ba2a62\",\"lessThan\":\"ec19cea4ef1ce9d6e2e3f7e9e7bf88ede31176e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae897e0bed0f5461a6b1c3259c7d899759ba2a62\",\"lessThan\":\"61c5165f02deb2eed9b6b539bb279e6629fee652\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae897e0bed0f5461a6b1c3259c7d899759ba2a62\",\"lessThan\":\"b7e53968cb8882c2d276429ea8550848a4940874\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/xfs/xfs_rtalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/61c5165f02deb2eed9b6b539bb279e6629fee652\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b7e53968cb8882c2d276429ea8550848a4940874\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec19cea4ef1ce9d6e2e3f7e9e7bf88ede31176e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T06:34:16+00:00",
      "cve": "CVE-2026-80538",
      "id": "CVE-2026-80538",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfs: propagate errors from xfs_rtginode_load",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80538.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T00:50:24Z",
      "cve": "CVE-2026-80538",
      "id": "CVE-2026-80538",
      "initial_release_date": "2026-08-27T00:12:20Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80538",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80538.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.