CVE-2026-80806

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows data written to newly created encrypted files to bypass encryption when the filesystem is mounted with the 'dax=always' option. This occurs due to an incorrect sequence in setting internal flags, which prevents the direct access (DAX) flag from being cleared. Consequently, sensitive information intended to be protected by encryption could be exposed.

A confidentiality issue in ext4 encrypted file creation can occur when the filesystem is mounted with dax always. A new encrypted regular file may incorrectly keep S_DAX because the encryption inode flag is set after the initial inode flag calculation, so DAX I/O can bypass the normal fscrypt encryption path and write plaintext data to storage. For the CVSS the PR:L is used because a local user who can create files in an affected encrypted directory can trigger the vulnerable behavior once the non default DAX configuration already exists. The issue is not network reachable and does not indicate memory corruption or kernel code execution. Impact is primarily confidentiality loss for data expected to be encrypted, with possible integrity policy impact because mount and encryption restrictions are not enforced as intended.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.