CVE-2026-80591 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix listxattr handling of corrupted xattr entries
Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The F2FS file system, developed by Samsung for flash-based storage devices such as SSDs and eMMC, implements extended attributes to store metadata associated with files beyond standard inode information. These extended attributes are stored in dedicated blocks within the file system structure, managed through a linked list of attribute entries. Each entry contains specific fields including size, name length, value offset, and flags that dictate how the data should be interpreted by the kernel. The integrity of these structures is critical for stable operation, as any corruption can lead to unpredictable behavior during file system operations.
A vulnerability existed in the f2fs_listxattr function within the Linux kernel where the code failed to adequately validate extended attribute entries before attempting to read their fields. Specifically, when iterating through the list of attributes, the implementation did not verify whether an entry's boundaries remained within the allocated xattr storage area. This oversight allowed a corrupted or maliciously crafted file system image containing out-of-bounds attribute entries to be processed without triggering appropriate error handling mechanisms. Instead of detecting the structural inconsistency and aborting the operation with an explicit corruption signal, the kernel proceeded to read data from invalid memory locations relative to the expected xattr block boundaries.
This flaw results in a potential information disclosure vulnerability or system instability depending on how the out-of-bounds access is handled by subsequent layers. If the corrupted entry points to valid but unintended memory regions within the file system metadata structures, it may lead to the exposure of sensitive internal data during attribute listing operations performed by user-space applications or system utilities like lsattr. Furthermore, if the invalid offset leads to reading uninitialized memory or triggers a page fault due to unmapped pages, it could cause kernel panics or denial of service conditions for processes interacting with affected files. The severity is compounded in environments where untrusted file systems are mounted, such as removable media handling scenarios.
From a classification perspective, this issue aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write if the corruption leads to subsequent writes during other operations triggered by malformed attributes. In terms of attack vectors, it relates to ATT&CK technique T1083 File and Directory Discovery, as an attacker could potentially leverage this flaw to enumerate sensitive metadata from a compromised or maliciously prepared storage device. The vulnerability highlights the importance of strict boundary checks in file system parsers that handle external inputs, particularly when dealing with complex data structures like linked lists of variable-length entries.
To mitigate this risk, users should ensure their Linux kernel is updated to include the patch addressing f2fs_listxattr validation logic. System administrators managing removable media or network-mounted volumes containing F2FS partitions must exercise caution and verify file system integrity before mounting untrusted storage devices. Additionally, implementing robust input validation at the user-space level when interacting with extended attributes can provide an additional layer of defense against malformed data inputs that might exploit similar parsing weaknesses in other components. Regular security audits focusing on file system driver code paths are recommended to identify and remediate analogous boundary check deficiencies across the kernel stack.