CVE-2026-80591

A flaw was found in the f2fs file system within the Linux kernel. This vulnerability arises from inadequate validation of extended attribute (xattr) entries during the f2fs_listxattr() function's operation. A local attacker could potentially create a corrupted xattr entry, causing the system to attempt to read data from outside the valid xattr storage area. This could lead to unexpected system behavior or the disclosure of sensitive information.

A moderate severity flaw was found in the f2fs file system of the Linux kernel. The f2fs_listxattr() function did not validate extended attribute (xattr) entries before reading their fields, so an entry outside the valid xattr storage area was processed and returned as a successful partial result instead of being rejected with an error. A local attacker able to create a corrupted xattr entry on an f2fs file system could use this flaw to cause the kernel to read data outside the valid xattr storage area, leading to unexpected system behavior or the disclosure of sensitive information. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel variants tracked in this flaw are not affected because the vulnerable code is not present in the shipped kernels. The upstream CVE.org record rates this flaw Important (7.8); Red Hat rates it Moderate (5.5) because the Red Hat assessment of the confidentiality and integrity impact is lower than the upstream rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.