CVE-2026-80804 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: restore nofs context unconditionally in xfs_trans_roll
When __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a circular lock dependency between xfs_nondir_ilock_class and fs_reclaim:
CPU0 CPU1 ---- ---- lock(&xfs_nondir_ilock_class); lock(fs_reclaim); lock(&xfs_nondir_ilock_class); lock(fs_reclaim);
Fix this by moving xfs_trans_set_context() before the error check so that nofs context is always restored on the new transaction.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's XFS filesystem implementation contained a concurrency-related flaw within the transaction management logic, specifically in the function responsible for rolling transactions known as xfs_trans_roll. This vulnerability stems from an incorrect handling of memory allocation contexts during error conditions. In high-concurrency environments where multiple threads interact with the file system simultaneously, proper context switching is critical to prevent deadlocks and resource contention issues. The specific issue arises when the internal commit operation fails; in such scenarios, the code incorrectly clears the no-filesystem (NOFS) flag but fails to restore it before returning or proceeding further. This oversight leaves subsequent operations unprotected against potential filesystem-related memory allocations that could trigger recursive locking attempts.
The technical root cause lies in the conditional restoration of the NOFS context. The original implementation only restored this critical protection mechanism on the success path of the transaction commit process. When __xfs_trans_commit encounters an error, it clears the flag but does not reinstate it before exiting or handling the failure state. This creates a window where subsequent locking operations are executed without the necessary safeguards against filesystem reclaim locks. The absence of this context leads to a circular lock dependency involving xfs_nondir_ilock_class and fs_reclaim. In practical terms, one CPU thread may acquire the inode lock while holding the filesystem reclaim lock, while another CPU thread attempts to do so in reverse order, resulting in a classic deadlock scenario where neither process can proceed because each is waiting for a resource held by the other.
From an operational perspective, this vulnerability manifests as system hangs or kernel panics under heavy I/O load when transaction rollbacks occur frequently. The circular dependency between xfs_nondir_ilock_class and fs_reclaim prevents the scheduler from making progress, effectively freezing file system operations that depend on these locks. This impacts system stability and availability, particularly in enterprise environments where XFS is used for large-scale data storage with high throughput requirements. The issue does not typically lead to remote code execution or privilege escalation but rather causes denial of service through resource exhaustion via deadlock conditions. Such instability can disrupt critical business applications relying on persistent storage integrity and consistent performance metrics.
To mitigate this risk, the vulnerability was addressed by restructuring the control flow within xfs_trans_roll to ensure that the NOFS context is set unconditionally before any error checks are performed. By moving the call to xfs_trans_set_context earlier in the execution path, developers guarantee that the protection mechanism remains active regardless of whether the transaction commit succeeds or fails. This change eliminates the race condition window and prevents the formation of circular dependencies between inode locks and filesystem reclaim mechanisms. System administrators should apply kernel updates containing this patch immediately to restore stability. Additionally, monitoring tools can be configured to detect potential deadlock signatures related to fs_reclaim contention for early warning in environments where patches cannot be applied instantly.
This flaw is categorized under CWE-830 which relates to inclusion of functionality from potentially untrusted sources or improper handling of context switches leading to security vulnerabilities through race conditions and deadlocks. In the MITRE ATT&CK framework, this aligns with techniques involving resource exhaustion and denial of service via system-level conflicts rather than direct exploitation by an attacker. The fix ensures robustness in concurrent file system operations by maintaining consistent state management across all execution paths including error handling routines. Maintaining strict adherence to locking protocols within kernel subsystems remains essential for preserving overall operating system integrity and preventing cascading failures due to localized concurrency bugs.