Linux Kernel XFS CVE-2026-80536

The vulnerability activates exclusively during XFS log recovery at mount time - meaning the crafted image must present a dirty (unclean) log, which requires either a purposely crafted log header or simulation of an unclean unmount. On standard Linux server configurations, mounting a block device requires CAP_SYS_ADMIN (root or equivalent), so exploitation is limited to users with administrative privilege, physical access supplying removable media, or scenarios where automount daemons (udisks2, autofs) are configured to allow unprivileged XFS mounting. Systems without automount and with strict mount privilege controls significantly limit the realistic attacker population. No network exposure exists - the crafted image must reach the host through a physical or privileged-software delivery path. The xlog_recover_do_reg_buffer() code path is only reached when the XFS log contains buffer log items with dirty bitmaps, a condition the attacker controls via the crafted image.

The CVSS 8.4 score is well-grounded for the heap corruption primitive: AV:L confirms local access is required, AC:L indicates no environmental preconditions beyond supplying the crafted image, and C:H/I:H/A:H reflects that kernel slab corruption can translate to full privilege escalation, data exposure, or crash. However, the PR:N metric deserves scrutiny - standard server configurations require elevated privilege (CAP_SYS_ADMIN) to mount XFS block devices, which would argue for PR:L or PR:H; PR:N is realistic only on desktop or embedded systems with automount daemons (udisks2, autofs) permitting unprivileged XFS mounting. EPSS data was not provided, limiting probabilistic exploitation forecasting. No KEV listing and no identified public POC suggest opportunistic exploitation is not currently observed. The affected version range spans from the kernel's initial git commit through multiple stable branches - a very wide installed base - meaning patch lag is a real concern even for smaller operations. Despite the local vector, the vulnerability sits squarely within the malicious-filesystem threat model that XFS defends against elsewhere, and the slab corruption primitive is powerful enough that kernel ASLR bypass via spray techniques is a plausible post-exploitation path.

An attacker prepares a malicious XFS disk image with a buffer log item where blf_len is set to a small value (e.g., one XFS_BLF_SHIFT-sized chunk) but the dirty bitmap has a bit set beyond the end of that region; the image is additionally crafted with a dirty log so recovery triggers on mount. The attacker delivers the image via USB, a loop-mounted network share, or by convincing an administrator to mount it, and the kernel's xlog_recover_do_reg_buffer() then executes the unbounded memcpy() at mount time, overwriting adjacent slab allocations with attacker-influenced data. No public proof-of-concept demonstrating a complete privilege escalation chain from this primitive has been identified at time of analysis.