CVE-2026-80537

A flaw was found in the Linux kernel's XFS filesystem. An off-by-one error in the rtrefcount btree root level validation allows a local attacker to craft a malicious XFS image. When this image is mounted, it can lead to a slab-out-of-bounds write, causing a kernel panic and a denial of service (DoS) on the system.

An off-by-one validation bug in the XFS realtime refcount btree root level can allow a crafted filesystem image to be accepted with bb_level equal to m_rtrefc_maxlevels. When a realtime refcount cursor is later initialized, bc_nlevels becomes one larger than bc_maxlevels and the first btree operation can index past the end of the xfs_rtrefcountbt_cur slab object. The observed failure is a slab out-of-bounds write in xfs_btree_lookup followed by a kernel panic. For the CVSS the PR:L is used in the paranoid score because practical exposure may include delegated mount paths, removable media automount, container root, or a local service that mounts user supplied filesystem images. The issue is not directly network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality and integrity impact due to kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.