CVE-2026-80536

A flaw was found in the Linux kernel's XFS filesystem. A local attacker, by mounting a specially crafted XFS image, could trigger an out-of-bounds write during log recovery. This vulnerability allows for kernel heap corruption, which could lead to a denial of service or potentially arbitrary code execution.

A slab out of bounds write can occur in the XFS mount time log recovery path because xlog_recover_do_reg_buffer used a dirty bitmap from the on disk buffer log item without a real runtime bounds check against the allocated buffer length. A crafted XFS image can encode a small blf_len together with dirty bitmap bits that point past the end of that buffer, causing memcpy to corrupt adjacent kernel heap memory during recovery. For the CVSS the PR:L is used because a reduced capability local user, container root, storage management service account, or delegated mount workflow may be able to cause a crafted XFS image to be mounted without full host administrator control. Impact can include kernel crash and, because the primitive is an attacker influenced kernel heap out of bounds write, potential privilege escalation or broader confidentiality and integrity impact should be considered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module xfs from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.