CVE-2026-80536: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80536 is an out-of-bounds write vulnerability in the Linux kernel's XFS filesystem log recovery mechanism, specifically in the xlog_recover_do_reg_buffer() function. A crafted XFS filesystem image can cause a heap buffer overflow during mount-time log recovery by specifying a dirty bitmap bit past the end of the logged buffer, corrupting adjacent kernel heap memory. The vulnerability affects the Linux kernel from version 2.6.12 up to (but not including) the fixed commits in stable branches, with fixes available in kernel versions 6.18.46, 7.1.10, and 7.2. It carries a CVSS v3.1 base score of 8.4 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in xlog_recover_do_reg_buffer(), which replays dirty regions from a buffer log item's bitmap into a kernel buffer using memcpy(). The destination offset and copy length are derived from the attacker-controlled dirty bitmap (bit and nbits) and the logged blf_len, which are otherwise unrelated — yet the only bounds check was an ASSERT() that compiles away on production (non-debug) kernels. An attacker crafts an XFS image with a small blf_len and a bitmap bit index beyond the end of the allocated buffer, causing memcpy() to write past the buffer's allocation boundary and corrupt adjacent kernel heap. The fix replaces the ASSERT() with a proper XFS_IS_CORRUPT() check that aborts recovery with -EFSCORRUPTED, consistent with the validate-and-fail idiom used elsewhere in XFS recovery code. The vulnerability was discovered and confirmed using KASAN on a CONFIG_XFS_DEBUG=n build (Red Hat Bugzilla, Kernel Announcement).

Successful exploitation allows an attacker who can cause a crafted XFS filesystem image to be mounted to corrupt adjacent kernel heap memory during log recovery, potentially leading to arbitrary kernel code execution or a system crash (denial of service). All three security dimensions are affected: confidentiality (kernel memory disclosure), integrity (arbitrary kernel code execution), and availability (kernel panic/crash). Because exploitation occurs at mount time with no privileges required, it fits the malicious-filesystem threat model and could be leveraged for local privilege escalation on systems that auto-mount removable media or process untrusted disk images (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The vulnerability is locally exploitable (attack vector: local) with no privileges required and no user interaction needed beyond causing the crafted image to be mounted. The CVE status is "Received" and the vulnerability was disclosed on August 26, 2026. No EPSS score or CISA KEV catalog entry is currently available for this CVE.

1. Craft a malicious XFS image: Create an XFS filesystem image with a deliberately small blf_len in the buffer log item header, combined with a dirty bitmap that contains set bits at indices beyond the end of the buffer described by blf_len.
2. Embed the malicious log: Ensure the crafted log is written into the XFS journal so it will be replayed during mount-time log recovery (e.g., by writing the log directly or using XFS tooling to construct a corrupt-but-plausible journal).
3. Trigger mount: Cause the target system to mount the crafted image — this could be via physical media insertion on systems with automount enabled, a container image, a VM disk, or a network share. No privileges are required beyond the ability to get the image mounted.
4. Heap corruption occurs: During xlog_recover_do_reg_buffer(), the unvalidated memcpy() writes past the allocated buffer into adjacent kernel heap, corrupting kernel data structures.
5. Achieve code execution or crash: Depending on heap layout and kernel version, the corruption may be leveraged to redirect kernel execution flow for privilege escalation, or may cause a kernel panic (Red Hat Bugzilla).

• Logs: Kernel messages containing XFS_IS_CORRUPT or -EFSCORRUPTED during mount of an XFS filesystem (on patched kernels, this indicates a crafted image was detected); KASAN slab-out-of-bounds write reports in kernel logs (BUG: KASAN: slab-out-of-bounds in xlog_recover_do_reg_buffer) on debug kernels.
• System Behavior: Unexpected kernel panics or system crashes immediately following the mount of an XFS filesystem image, particularly from external or untrusted sources.
• File System: Presence of unusual or externally sourced XFS disk images being mounted on systems that do not normally process untrusted filesystems.

Apply the upstream kernel patch that replaces the ASSERT() in xlog_recover_do_reg_buffer() with a proper XFS_IS_CORRUPT() bounds check, aborting recovery with -EFSCORRUPTED when a dirty bitmap bit exceeds the logged buffer length. Fixed kernel versions are 6.18.46, 7.1.10, and 7.2 (upstream). As a workaround, avoid mounting XFS filesystem images from untrusted sources, and disable automounting of removable media where possible. Enabling kernel module signing and Secure Boot can reduce the risk of post-exploitation persistence (Red Hat Advisory, Red Hat Bugzilla).