CVE-2026-80535 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't double-lock when deleting a self-referential directory
LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this case, it's not correct for the directory tree repair code to try to iolock/ilock both sc->ip and dp, because they're the same inode. Fix this by detecting that corner case and handling it appropriately.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel’s XFS filesystem implementation contains a logic flaw in its directory tree scrubbing and repair mechanisms that can lead to improper locking behavior when processing self-referential directories. This vulnerability is identified as CWE-674, which pertains to Uncontrolled Recursion or Infinite Looping, specifically manifesting here through the misuse of mutex locks on identical resources. The issue arises within the dirtree scrubber component, a subsystem responsible for verifying and repairing inconsistencies in the directory structure of XFS filesystems. Under normal circumstances, when traversing directory entries, the repair code acquires inode locks (ilock) and I/O locks (iolock) to ensure data integrity during modifications. However, if a directory entry points back to its own parent or itself, creating a self-referential loop, the scrubber incorrectly attempts to lock both the current inode being processed and the target of the reference. Since these two references point to the exact same in-memory inode structure, this results in an attempt to acquire locks that are already held by the current context, leading to a deadlock or kernel panic depending on the locking semantics employed at the time of execution.
From a technical perspective, the flaw lies in the lack of identity checks before acquiring dual locks for directory traversal operations. The XFS repair code assumes that source and destination inodes in a link operation are distinct entities requiring separate lock acquisition to prevent race conditions with other processes accessing those files. When dealing with self-referential directories, this assumption breaks down because sc->ip (the inode being scrubbed) and dp (the directory pointer being referenced) resolve to the same kernel object. Attempting to double-lock a single mutex or spinlock without proper nesting awareness triggers either an immediate deadlock if the lock is non-recursive, or undefined behavior if recursive locking rules are violated elsewhere in the call stack. This represents a significant stability risk for systems relying on XFS filesystems with potentially corrupted directory structures that include such anomalies.
The operational impact of this vulnerability includes potential denial of service through kernel hangs or crashes during routine filesystem maintenance tasks like fsck or online scrubbing operations. An attacker who can induce the creation of self-referential directories, either through local privilege escalation exploiting prior vulnerabilities or by manipulating a mounted volume with sufficient write permissions, could trigger this code path. While direct remote exploitation is unlikely due to the requirement for specific filesystem state manipulation, the vulnerability compromises system reliability and availability. It falls under MITRE ATT&CK technique T1490, Inhibit System Recovery, as it prevents the operating system from successfully repairing its own file system structures, thereby hindering recovery efforts after corruption or attack-induced damage.
Mitigation strategies primarily involve applying the upstream kernel patch that introduces a check to detect when sc->ip and dp refer to the same inode before attempting dual lock acquisition. Administrators should ensure their systems are updated with the latest stable Linux kernel versions where this fix is included. For environments unable to immediately update, monitoring filesystem scrub logs for errors related to directory tree inconsistencies may provide early warning of affected states. Additionally, ensuring that backup and recovery procedures do not inadvertently create circular references during restoration processes can help prevent triggering this condition in legacy systems until patches are applied.