CVE-2026-80533 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
LOLLM noticed a longstanding bug where xrep_iunlink_walk_ondisk_bucket tries to walk ragi->sc->sa.agi_bp to rebuild the unlinked inode lists. Unfortunately, it's possible for agi_bp to be null if the buffer verifier fails, so we have to use ragi->agi_bp (which skips verifier checks) instead.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel’s XFS filesystem implementation contains a critical logic flaw within its on-disk metadata repair mechanisms, specifically affecting the AGI inode unlinked list reconstruction process. This vulnerability arises from an improper handling of buffer pointers during the recovery phase when dealing with corrupted or inconsistent filesystem structures. The function xrep_iunlink_walk_ondisk_bucket is responsible for traversing and rebuilding the lists of inodes that have been deleted but not yet fully removed from the directory structure, a necessary step to maintain filesystem consistency after crashes or power failures. However, under certain conditions where the buffer verifier fails during initial validation, the pointer sc->sa.agi_bp may remain null because the verification process aborts before assigning a valid buffer reference.
This oversight leads directly to a NULL pointer dereference when the repair routine attempts to access data through this invalid pointer. In kernel space, such an error typically results in a system crash or panic, effectively causing a denial of service condition for any host relying on that XFS volume. The root cause is identified as a longstanding bug where the code incorrectly assumes that agi_bp will always be populated after verification steps, failing to account for scenarios where early termination due to verifier errors leaves the pointer uninitialized. This represents a classic case of improper input validation and error handling within low-level storage subsystems, where assumptions about data integrity are not sufficiently guarded against edge cases in corrupted media or complex failure modes.
From a security perspective, this vulnerability aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities that can lead to application crashes or unexpected termination of processes. In the context of operating system kernels, such flaws are particularly severe because they compromise availability and potentially stability across all mounted filesystems on the affected host. While primarily a reliability issue rather than an exploit vector for privilege escalation in most standard configurations, it highlights weaknesses in defensive programming practices within critical infrastructure components. The ATT&CK framework categorizes this type of kernel-level instability under techniques that impact system availability, although specific mapping to tactical phases depends on whether the vulnerability can be triggered remotely or requires local access with elevated privileges to initiate filesystem repair operations.
Mitigation strategies primarily involve applying vendor-provided patches that update the XFS subsystem code to correctly reference ragi->agi_bp instead of sc->sa.agi_bp during the unlinked inode list reconstruction phase. This alternative pointer bypasses strict verifier checks, allowing the repair process to proceed even when initial validation fails, thereby preventing the null dereference condition. System administrators should ensure that their Linux distributions are updated with the latest kernel versions containing this fix. Additionally, regular filesystem consistency checks using tools like xfs_repair can help identify and resolve underlying metadata corruption before it triggers these edge-case bugs during automated repair routines. Maintaining up-to-date security patches is essential to mitigate risks associated with such low-level structural flaws in storage drivers.