Cloudanix VulnDB

CVE-2026-80805

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel checks certain file attribute data on XFS filesystems could let an attacker crash the system or read internal memory by feeding it specially crafted files.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in xfs_attr3_leaf_verify_entry() where lentry/rentry fields (namelen, valuelen) are accessed before verifying the entry pointer lies within the buffer, allowing crafted nameidx values near the buffer end to trigger reads past buf_end.

Why it matters to the business

Potential kernel crashes or information disclosure on systems using XFS filesystems with extended attributes; may require emergency patching and reboot cycles that interrupt storage services and workloads.

How an attack unfolds

An attacker supplies a malicious XFS filesystem image or extended attribute structure with a crafted nameidx that positions the entry pointer near the end of the leaf buffer. When the kernel performs attribute verification, the code reads namelen/valuelen fields before the name_end > buf_end check, resulting in an out-of-bounds read that can leak kernel memory or cause a panic.

How to fix it

Apply the upstream fix that adds explicit bounds checks using offsetof() on the nameval/name flexible array member before field access. Rebuild and deploy the patched kernel; no user-space changes required.

How to confirm the fix worked

Confirm the patch is present by inspecting the xfs_attr3_leaf_verify_entry() function for the new offsetof-based bounds checks prior to namelen/valuelen access. Test with crafted XFS images that previously triggered the flaw.

Typical attack path

  1. Craft malicious XFS image or extended attribute metadata with out-of-bounds nameidx
  2. Mount or access the image on a vulnerable kernel triggering xfs_attr3_leaf_verify_entry()
  3. Trigger verification path during attribute lookup or list operations
  4. Observe kernel oops, memory disclosure, or system instability

How to detect it

Review kernel logs for oops/panic traces mentioning xfs_attr3_leaf_verify_entry or xfs_attr3_leaf; inspect mounted XFS volumes for malformed attribute leaf blocks via xfs_db or similar tools.

What your security team should do

  • Prioritize kernel update on all systems using XFS with extended attributes
  • Monitor for kernel oops reports referencing xfs_attr* functions
  • Restrict untrusted XFS filesystem mounts until patched

The record

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed. Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access.

Affected packages

Ecosystem Package Introduced Fixed