Linux Kernel XFS CVE-2026-80537

Exploitation requires three concurrent conditions: (1) the target kernel must be compiled with XFS realtime support (CONFIG_XFS_RT) and the reflink/metadir features enabled; (2) the attacker must be able to cause the kernel to mount a crafted XFS filesystem image with the metadir+realtime+reflink feature set - this requires either CAP_SYS_ADMIN, an enabled unprivileged user namespace mount path, or the ability to present a malicious block device; (3) the crafted image's /rtgroups/N.refcount inode must have bb_level set to exactly m_rtrefc_maxlevels. Exploitation is strictly local - there is no network attack vector. Standard XFS deployments without a realtime device are entirely unaffected. A second trigger path (FS_IOC_GETFSMAP over the realtime device) is also available post-mount but requires the same feature preconditions.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the described primitive: low-privilege local access is sufficient, no interaction is required, and the attack complexity is low once a crafted image is prepared. The slab-out-of-bounds write of 2 bytes in kernel heap space represents at minimum a reliable local denial-of-service (kernel panic on mount) and potentially a kernel code execution primitive - the KASAN trace and 'Kernel panic - not syncing' message confirm the DoS path. Full privilege escalation is plausible via heap grooming given a write primitive at a known relative offset, though no proof-of-concept has been published. The primary risk-limiting factor is the required XFS feature combination (metadir + realtime + reflink), which is non-default and narrows the exploitable population significantly. No EPSS score was provided and the CVE is absent from CISA KEV, consistent with no observed in-the-wild exploitation. The attack is also exploitable via FS_IOC_GETFSMAP on the realtime device after mount, providing a second trigger path. On systems permitting unprivileged mounts via user namespaces, the effective privilege bar drops further.

A local user with low privileges crafts a malicious XFS filesystem image with the metadir+realtime+reflink feature combination, setting the /rtgroups/N.refcount inode's bb_level field to m_rtrefc_maxlevels (one beyond the valid maximum). When the image is mounted - directly by the attacker if unprivileged mounts are permitted, or by tricking an administrator - the kernel's CoW recovery path during xfs_mountfs() builds an rtrefcount cursor and immediately writes two bytes 8 bytes past the slab object boundary, producing a kernel panic at minimum; with heap grooming, an attacker may achieve arbitrary kernel code execution and root privilege escalation.