CVE-2026-80805

A flaw was found in the Linux kernel's XFS filesystem. The xfs_attr3_leaf_verify_entry() function fails to validate an attribute entry pointer before accessing its fields. A local attacker could exploit this by crafting a malicious attribute index (nameidx) to cause an out-of-bounds read. This could lead to the disclosure of sensitive information or a denial of service.

xfs_attr3_leaf_verify_entry can access attr entry fields before checking that the computed local or remote entry pointer is inside the attr leaf buffer. A crafted XFS metadata block with nameidx pointing near the end of the buffer can therefore cause an out-of-bounds read before the later name_end bounds validation runs. For the CVSS the PR:L is used in the paranoid score because a non-root local actor may be able to supply a crafted filesystem image to a delegated mount workflow, container environment, test runner, or other privileged helper, even though direct mounting usually requires administrator privileges. The issue is not network reachable and normally requires local processing of a crafted or corrupted XFS filesystem. Impact is at least denial of service via kernel crash or filesystem processing failure. A limited confidentiality impact is kept only for the paranoid score because the primitive is an out-of-bounds read, but there is no clear direct information disclosure path in the shown code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.