CVE-2026-80805 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: validate attr entry pointer before field access
xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed.
Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's XFS filesystem implementation contained a critical logic error in its attribute leaf verification routine, specifically within the xfs_attr3_leaf_verify_entry function. This vulnerability stems from an incorrect order of operations during data validation, where field accesses precede boundary checks. In normal operation, this code path is responsible for verifying the integrity and validity of extended attributes stored on disk structures known as XFS attribute leaves. These structures contain variable-length entries that include metadata fields such as namelen and valuelen, which describe the length of the attribute name and value respectively. The security flaw arises because the kernel attempts to read these specific integer fields from a pointer provided by an index before confirming that the pointer itself points to a valid location within the allocated buffer boundaries.
The technical root cause is a classic out-of-bounds read vulnerability triggered when the input parameter nameidx, which serves as an offset or index into the attribute leaf structure, is crafted to point near the end of the memory buffer. When this maliciously constructed index is used, the function proceeds to dereference pointers and access struct members like namelen and valuelen without first ensuring that these fields reside within the allocated memory region. Because C language structures are laid out sequentially in memory, accessing a field at an offset requires that the base pointer plus that offset falls entirely within valid memory pages. By performing this access prior to checking if name_end exceeds buf_end, the kernel risks reading arbitrary data from adjacent memory locations or triggering a page fault exception if the address is unmapped. This behavior aligns with CWE-125, which describes out-of-bounds read vulnerabilities where software reads past the end of a buffer.
The operational impact of this vulnerability depends heavily on the context in which it can be triggered and whether an attacker has local access to the system. If exploitable by unprivileged users through mount operations or specific file attribute manipulations, it could lead to information disclosure, allowing attackers to leak sensitive kernel memory contents such as stack variables, other process data, or cryptographic keys. Alternatively, if the out-of-bounds read causes a null pointer dereference or accesses invalid memory pages due to subsequent logic relying on corrupted values, it may result in a denial of service via kernel panic or system crash. While this is primarily an information leak and stability issue rather than direct code execution, such vulnerabilities often serve as stepping stones for more complex attacks by providing the attacker with valuable memory layout information useful for bypassing security mitigations like ASLR.
To mitigate this risk, the Linux kernel maintainers implemented a fix that enforces strict bounds checking before any field access occurs within the verification routine. The solution involves adding explicit checks to ensure that the entry pointer is valid and contained within the buffer limits prior to dereferencing it. Specifically, the patch utilizes the offsetof macro to verify that the start of the flexible array member, which represents the nameval or name data portion of the structure, lies safely within the allocated bounds. This approach guarantees that all preceding fields in the struct are also safe to access since they logically precede the flexible array member in memory layout. This fix aligns with secure coding practices recommended by CWE-20 for proper input validation and ensures that structural integrity checks occur before data consumption.
From a threat intelligence perspective, this type of vulnerability is often associated with local privilege escalation attempts where attackers seek to gain unauthorized access to kernel space or sensitive information from other processes. In the MITRE ATT&CK framework, such vulnerabilities may be leveraged during techniques related to collection and exfiltration if successful memory reads are achieved, though they are most commonly categorized under initial exploitation vectors for gaining higher privileges on compromised systems. System administrators should ensure that their Linux kernels are updated with patches addressing this specific XFS attribute validation flaw to prevent potential information leaks or system instability caused by malformed extended attributes in filesystem images or network-mounted volumes.