CVE-2026-80531 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: avoid UAF on sc->tempip in xrep_tempfile_create
LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc->tempip. Fix that.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's XFS filesystem implementation contains a critical use-after-free vulnerability within the temporary file creation logic, specifically in the xrep_tempfile_create function. This flaw arises from an improper handling of error paths during the initialization and allocation phases of a temporary inode structure. When the system attempts to create a temporary inode for repair operations or other internal processes, it assigns a pointer to this newly allocated or referenced inode object to the sc->tempip field within the scrub context structure. Under normal execution conditions where all resource allocations succeed, this reference is managed correctly and released appropriately upon completion of the task. However, if an intermediate step in the creation process fails—such as due to memory pressure, quota limits, or filesystem corruption—the code path may exit prematurely without properly releasing the previously assigned sc->tempip pointer.
This oversight results in a dangling pointer scenario where the kernel retains a reference to an inode object that has either been freed by another part of the subsystem or is no longer valid for access. Subsequent operations within the same scrub context that attempt to dereference sc->tempip will trigger a use-after-free condition. In the Linux memory management model, accessing freed memory can lead to unpredictable behavior including kernel panics, data corruption, or potentially arbitrary code execution if an attacker can control the contents of the reclaimed memory slab. The vulnerability is particularly dangerous because it occurs during filesystem repair and scrubbing operations which are often triggered automatically by the system when inconsistencies are detected, meaning a local user with access to trigger such repairs could exploit this flaw without needing elevated privileges initially, although exploitation typically requires specific conditions related to filesystem state and timing.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes situations where software continues to use memory after it has been freed. The operational impact is severe as it compromises the stability of the kernel and potentially the integrity of the data stored on XFS volumes. An attacker could leverage this flaw to cause a denial of service by crashing the system or attempting more sophisticated attacks if they can manipulate the heap layout to execute malicious code upon dereferencing the invalid pointer. The vulnerability highlights the importance of rigorous error handling in low-level kernel subsystems where resource lifecycle management is complex and interdependent.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that resolves this issue by ensuring that sc->tempip is properly cleared or released before any early exit from the xrep_tempfile_create function. System administrators should ensure their systems are updated with the latest stable kernel versions that include fixes for XFS scrubbing routines. Additionally, monitoring system logs for signs of filesystem repair activities followed by unexpected crashes can help identify potential exploitation attempts in real-time. Security teams should also review configurations related to memory allocation limits and quota settings on XFS partitions to reduce the likelihood of triggering the specific failure conditions that lead to this vulnerability being exercised.