CVE-2026-80538 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: propagate errors from xfs_rtginode_load
xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs then continues as though the inode had been loaded.
Only -ENOENT means that the inode needs to be created. Return all other errors to the growfs caller.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's XFS filesystem implementation contains a logic flaw within the realtime group inode loading mechanism, specifically in how error conditions are handled during initialization and growth operations. The function xfs_rtginode_ensure is responsible for ensuring that the metadata structures required for managing realtime groups are properly initialized. However, this routine incorrectly interprets any failure from the underlying load operation, xfs_rtginode_load, as a success condition unless the specific error code returned is -ENOENT, which indicates that the inode does not yet exist and needs to be created. This flawed logic stems from an incomplete handling of negative return values, where transient I/O errors, allocation failures, or filesystem corruption indicators are mistakenly treated as non-fatal events rather than critical failure states requiring immediate propagation up the call stack.
This misclassification of error codes leads to a state inconsistency within the XFS metadata structures. When xfs_rtginode_load encounters an actual problem such as disk I/O errors, memory allocation failures during inode retrieval, or detected corruption in the realtime group bitmap, it returns a negative errno value indicating failure. Due to the bug, xfs_rtginode_ensure ignores these specific error codes and proceeds under the assumption that the operation succeeded. Consequently, the pointer or structure representing the realtime group inode remains unset or uninitialized. This leaves the filesystem driver with an incomplete view of its own metadata state, effectively creating a scenario where subsequent operations believe valid resources are available when they are not.
The operational impact becomes most severe during filesystem growth operations initiated by tools such as growfs. When xfs_growfs attempts to expand the realtime volume, it relies on the successful loading and initialization of group inodes to proceed with allocating new blocks and updating metadata. Because the error from xfs_rtginode_load is suppressed, growfs continues its execution path assuming that all necessary inode data has been successfully loaded into memory. This can result in subsequent allocations targeting invalid or null pointers, leading to kernel panics, silent data corruption of the realtime volume structure, or unpredictable filesystem behavior during expansion attempts. The integrity of the realtime allocation group metadata is compromised because the system fails to abort early when critical infrastructure components cannot be accessed.
From a vulnerability classification perspective, this issue aligns with CWE-253, which describes an incorrect check for an unusual or exceptional condition. By treating all non-not-found errors as success, the code violates the principle of explicit error handling and assumes that any outcome other than missing data is acceptable. This logic flaw can also be mapped to ATT&CK technique T1496, Resource Hijacking, in contexts where the corruption leads to unstable system states that could potentially be exploited for denial-of-service conditions through repeated growth attempts or metadata manipulation. The failure to propagate errors prevents higher-level subsystems from implementing appropriate recovery strategies, such as remounting read-only or triggering filesystem checks via fsck upon next boot.
To mitigate this vulnerability and restore correct operational behavior, the kernel code must be updated to strictly differentiate between the -ENOENT condition and all other error codes returned by xfs_rtginode_load. The fix involves modifying xfs_rtginode_ensure so that it returns any negative value from the load function directly to its caller rather than masking them as success. This ensures that growfs and other consumers of this API receive accurate feedback regarding the health of the realtime group inode structures. By propagating these errors, the filesystem driver can abort operations safely when metadata cannot be reliably accessed, thereby preserving data integrity and preventing kernel instability caused by operating on uninitialized or corrupted inodes.