CVE-2026-80535: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80535 is a double-lock vulnerability in the Linux kernel's XFS filesystem subsystem, specifically in the directory tree repair code. When the XFS dirtree scrubber detects a directory that references itself (a self-referential directory), the repair code incorrectly attempts to acquire both iolock and ilock on sc->ip and dp, which are the same inode, leading to a deadlock condition. The vulnerability affects Linux kernel versions starting from 6.10 up to (but not including) the fixed releases. It carries a CVSS base score of 0.0 as currently assessed by ENISA, with Red Hat classifying it as low severity (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-764 (Multiple Locks of a Critical Resource). The XFS directory tree repair code (xfs_repair_dirtree) fails to check whether the inode being processed (sc->ip) is the same as the directory inode (dp) before attempting to acquire both iolock and ilock on each. When a malformed or corrupted XFS filesystem contains a directory that lists itself as a parent or child, the scrubber identifies this self-referential structure and the repair path triggers the double-lock attempt on the same inode, causing a kernel deadlock. The fix involves detecting this corner case — where sc->ip == dp — and handling it appropriately to avoid the redundant lock acquisition (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can cause a kernel deadlock, resulting in a denial of service (system hang or crash) on the affected host. A local attacker with access to an XFS filesystem could craft or present a self-referential directory structure to trigger the double-lock condition. There is also a potential for filesystem data corruption depending on the state of the kernel when the deadlock occurs. The impact is limited to availability and integrity of the local system; there is no known path to remote code execution or privilege escalation from this vulnerability alone (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-80535. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability requires local filesystem access and the presence of a self-referential directory structure, which significantly limits the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

Patches have been backported to multiple stable Linux kernel branches. The fixed versions are: 6.12.105, 6.18.46, 7.1.10, and 7.2 (mainline). The corresponding upstream fix commits are 17bc347cbdfb, ce2a7006ec5e, c575904471570, and 5fc643fb86599. Users should update to a patched kernel version as soon as possible. No configuration-based workaround is available; the only remediation is applying the upstream kernel patch (Red Hat CVE, Red Hat Bugzilla).