Linux Kernel XFS CVE-2026-80538

Exploitation requires a local account with privileges sufficient to influence or trigger xfs_growfs execution on the target system (typically root, which conflicts with the PR:L CVSS rating - see confidence notes). The filesystem must be XFS with a realtime subvolume configured; standard XFS deployments without a realtime section do not exercise this code path. The bug only manifests when xfs_rtginode_load() returns a non-ENOENT error code - specifically an I/O error (EIO), memory allocation failure (ENOMEM), or on-disk corruption indicator (EFSCORRUPTED) - during the growfs operation. Normal filesystem read, write, and mount operations do not traverse this path. Exploitation is therefore limited by: (1) requirement for a non-default XFS realtime subvolume, (2) a concurrent or engineered storage-level error condition during growfs, and (3) the ability to initiate or observe growfs execution.

The official CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) captures the local attack vector and high integrity and availability impact. The AC:L rating appears optimistic: exploitation requires a non-default XFS realtime subvolume configuration AND the ability to induce an I/O, allocation, or corruption error specifically during a growfs operation, which in practice elevates attack complexity. No EPSS data was supplied, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, so real-world risk is currently theoretical. The practical threat surface is substantially narrowed by the XFS realtime subvolume prerequisite, a specialized configuration absent from most general-purpose Linux deployments; administrators should verify whether their XFS volumes include a realtime section before treating this as an urgent priority. The CVSS confidentiality metric of N is consistent with the description - no data exfiltration pathway is described. The integrity and availability impacts are credible: a null pointer dereference in kernel context produces a kernel panic, and if execution continues past the null dereference, metadata corruption on the realtime subvolume is possible.

A local attacker with low-privilege access on a system running a vulnerable kernel triggers or waits for a transient I/O error on an XFS realtime subvolume during a growfs operation - achievable in virtualized environments by injecting block device errors or by operating on degraded storage. The xfs_rtginode_load() call returns EIO, which xfs_rtginode_ensure() discards as though the inode was successfully loaded, leaving gi_inode NULL. When growfs subsequently dereferences the null pointer, the kernel panics and reboots the system, or if execution proceeds further, realtime subvolume metadata is overwritten at address zero, corrupting the filesystem. No public exploit code has been identified at time of analysis.