CVE-2026-80537— xfs: fix off-by-one in rtrefcount btree root level validation
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该 Linux 内核漏洞描述信息的中文翻译： --- Linux 内核中，以下漏洞已得到修复： xfs：修复 rtrefcount btree 根层级校验中的差一（off-by-one）错误 函数设置了如下内容： 其中，末尾的 已经计入了 inode-根层级。因此，磁盘上有效的最深层级为 ，而游标（cursor）必须满足 （即 ）。 两个磁盘校验路径 和 在检查根层级时使用了 而非 。因此，一个精心构造的包含 rtreflink（metadir + 实时分区 + reflink）的文件系统镜像，若其 inod
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1562 T1201 · Password Policy DiscoveryAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0< 8a0ecae2ecda9f9a83a496ed05c42c4b1f5c3f2d |
affected |
9abe03a0e4f978615a2b1b484b8d09ca84c16ea0< ccebfc309441e0b37b2e6ece90f18810a489d326 |
affected | ||
9abe03a0e4f978615a2b1b484b8d09ca84c16ea0< cc3144da377de5fb422d44a2311f978623f7c900 |
affected | ||
6.14 |
affected | ||
< 6.14 |
unaffected | ||
6.18.46≤ 6.18.* |
unaffected | ||
7.1.10≤ 7.1.* |
unaffected | ||
7.2≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80537
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
xfs: fix off-by-one in rtrefcount btree root level validation
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix off-by-one in rtrefcount btree root level validation
xfs_rtrefcountbt_compute_maxlevels() sets
mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;
where the trailing "+ 1" already accounts for the inode-root level, so the
deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must
satisfy bc_nlevels <= bc_maxlevels (= m_rtrefc_maxlevels).
The two on-disk validation paths, xfs_rtrefcountbt_verify() and
xfs_iformat_rtrefcount(), check the root level with ">" instead of ">=", so a
crafted rtreflink (metadir + realtime + reflink) image whose
/rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on
mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1,
exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is
sized for exactly bc_maxlevels entries, the first btree op on such a cursor
indexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is
reached by the first rtrefcount cursor built after mount, via log/CoW
recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an
FS_IOC_GETFSMAP over the realtime device.
Reject a root level equal to m_rtrefc_maxlevels, matching the ">=" form
already used by the sibling data-device refcount/rmap verifiers and the
in-memory rtrmap verifier.
BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)
Write of size 2 at addr ffff888018391658 by task exploit/144
xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)
xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308)
xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113)
xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085)
xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551)
xfs_mountfs (fs/xfs/xfs_mount.c:1158)
xfs_fs_fill_super (fs/xfs/xfs_super.c:1940)
get_tree_bdev_flags (fs/super.c:1634)
vfs_get_tree (fs/super.c:1694)
path_mount (fs/namespace.c:4161)
__x64_sys_mount (fs/namespace.c:4367)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216
The buggy address is located 8 bytes to the right of
allocated 216-byte region [ffff888018391578, ffff888018391650)
Kernel panic - not syncing: Fatal exception
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-80537
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80537
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-80537 (3)
Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total
| CVE-2026-80557 | 9.8 CRITICAL | libceph: fix OOB read in decode_watchers() via missing bounds check |
| CVE-2026-74737 | 9.8 CRITICAL | net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG |
| CVE-2026-80589 | 9.8 CRITICAL | block: stop the timeout timer when releasing a never added disk |
| CVE-2026-80587 | 9.8 CRITICAL | mptcp: avoid combining some incoming suboptions |
| CVE-2026-74743 | 9.8 CRITICAL | macvlan: inherit needed_headroom and needed_tailroom from lowerdev |
| CVE-2026-74744 | 9.8 CRITICAL | ipvlan: inherit needed_headroom and needed_tailroom from phy_dev |
| CVE-2026-74746 | 9.8 CRITICAL | netfilter: flowtable: publish GC-visible tuple last |
| CVE-2026-80561 | 9.8 CRITICAL | libceph: fix multiple unsafe decodes in decode_locker() |
| CVE-2026-80558 | 9.8 CRITICAL | libceph: Avoid using invalid osd indices from primary_temp |
| CVE-2026-74752 | 9.8 CRITICAL | sctp: validate cookie AUTH state before use |
| CVE-2026-80586 | 9.8 CRITICAL | mptcp: options: reset DSS fields in case of unexpected size |
| CVE-2026-80519 | 9.8 CRITICAL | ovpn: finish crypto callback cleanup before peer release |
| CVE-2026-80528 | 9.8 CRITICAL | ceph: avoid fs reclaim while using current->journal_info |
| CVE-2026-80585 | 9.4 CRITICAL | mptcp: fastopen: only mark MPTFO subflows with SYN data |
| CVE-2026-74751 | 9.4 CRITICAL | riscv: lib: Fix ZBB strnlen reading past count boundary |
| CVE-2026-80554 | 9.3 CRITICAL | s390/vfio_ccw: Limit the number of channel program segments |
| CVE-2026-80551 | 9.3 CRITICAL | s390/vfio_ccw: Ensure first IDAW remains constant |
| CVE-2026-80553 | 8.8 HIGH | s390/vfio_ccw: Cancel existing workqueues |
| CVE-2026-80576 | 8.8 HIGH | drm/amdgpu: reject oversized IBs with per-ring packet limits |
| CVE-2026-80548 | 8.8 HIGH | s390/vfio_ccw: Selectively expand io_mutex |
Showing top 20 of 92 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
Same vendor: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
V. Comments for CVE-2026-80537
No comments yet