CVE-2026-80537: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80537 is an off-by-one error in the Linux kernel's XFS filesystem subsystem, specifically in the rtrefcount B-tree root level validation logic. The flaw affects Linux kernel versions starting from 6.14, with fixes available in 6.18.46, 7.1.10, and 7.2. The vulnerability arises because xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount() use > instead of >= when comparing the root level against m_rtrefc_maxlevels, allowing a crafted XFS image to pass validation. It was disclosed on August 26, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an off-by-one validation error (CWE-787: Out-of-bounds Write) in the XFS rtrefcount B-tree root level check. xfs_rtrefcountbt_compute_maxlevels() sets m_rtrefc_maxlevels with a +1 already accounting for the inode-root level, meaning the deepest valid on-disk root level is m_rtrefc_maxlevels - 1. However, the two validation paths use > instead of >=, so a crafted rtreflink filesystem image with /rtgroups/N.refcount inode having bb_level == m_rtrefc_maxlevels passes mount-time validation. When xfs_rtrefcountbt_init_cursor() initializes a cursor from this inode, it sets bc_nlevels = bb_level + 1, exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, the first B-tree operation indexes bc_levels[m_rtrefc_maxlevels] past the end of the allocated object. This out-of-bounds write is triggered via log/CoW recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an FS_IOC_GETFSMAP ioctl on the realtime device (Red Hat Bugzilla).

Successful exploitation can result in kernel memory disclosure or a kernel panic (denial of service), as demonstrated by the KASAN report showing a slab-out-of-bounds write of 2 bytes past the end of the xfs_rtrefcountbt_cur object. An attacker who can mount a crafted XFS filesystem image — for example, via a removable device, a network share, or a container image — can trigger the out-of-bounds access during mount or subsequent filesystem operations. The CVSS score reflects high confidentiality, integrity, and availability impact, with the attack requiring only low privileges and no user interaction (Red Hat Bugzilla, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to craft a malicious XFS filesystem image and have it mounted by the target system, which limits the attack surface to scenarios involving untrusted storage media, container images, or similar vectors. No threat actor attribution has been reported (Red Hat Advisory).

1. Craft a malicious XFS image: Using XFS filesystem tools (e.g., mkfs.xfs with metadir, realtime, and reflink features enabled), create an XFS image where the /rtgroups/N.refcount inode's bb_level field is set to exactly m_rtrefc_maxlevels — one level beyond the valid maximum — bypassing the off-by-one validation check.
2. Deliver the image to the target: Place the crafted image on a removable device, network share, container layer, or other medium accessible to the target system running a vulnerable Linux kernel (6.14 through pre-fix versions).
3. Trigger mount: Cause the target system to mount the crafted XFS filesystem. This can be done directly (e.g., mount /dev/sdX /mnt) or indirectly via automount, container runtime, or similar mechanism.
4. Trigger out-of-bounds access: Upon mount, the kernel's xfs_mountfs() calls xfs_reflink_recover_cow(), which builds an rtrefcount cursor. With bc_nlevels exceeding bc_maxlevels by one, the first B-tree operation writes 2 bytes past the end of the slab-allocated xfs_rtrefcountbt_cur object, potentially causing kernel memory corruption, disclosure, or a kernel panic. Alternatively, issuing FS_IOC_GETFSMAP on the realtime device after mount achieves the same effect (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg) showing BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup with a write past the xfs_rtrefcountbt_cur slab object; kernel panic messages referencing xfs_btree_lookup, xfs_refcount_recover_cow_leftovers, or xfs_reflink_recover_cow.
• Process: Processes named exploit or unexpected processes triggering mount syscalls or FS_IOC_GETFSMAP ioctls on XFS realtime devices.
• File System: Presence of XFS images with rtreflink features (metadir + realtime + reflink) from untrusted sources; /rtgroups/N.refcount inodes with anomalous bb_level values equal to or exceeding the filesystem's computed m_rtrefc_maxlevels.
• Network: Unexpected mounting of network-hosted XFS images or container layers from external sources on systems running affected kernel versions (Red Hat Bugzilla).

Apply the upstream kernel patch that changes the root level comparison from > to >= in both xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount(), matching the logic already used by sibling data-device refcount/rmap verifiers. Fixed versions are available in Linux kernel 6.18.46, 7.1.10, and 7.2. As a workaround prior to patching, avoid mounting XFS filesystems from untrusted sources, and consider restricting unprivileged mount capabilities (e.g., via user namespace restrictions or disabling CONFIG_USER_NS). Filesystem image validation tools can be used to inspect rtrefcount inode structures before mounting (Red Hat Advisory, Red Hat Bugzilla).