CVE-2026-80820 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't livelock in scrub on a circular unlinked list
LOLLM points out that online fsck can livelock if an unlinked inode list contains a loop. Use a bitmap to detect cycles.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's XFS filesystem implementation contained a critical logic flaw within its online file system check utility, commonly referred to as xfs_scrub or fsck.xfs. This vulnerability specifically affects the mechanism used to traverse and validate unlinked inode lists during consistency checks. Unlinked inodes are directory entries that have been removed from their parent directories but still exist on disk because they remain open by one or more processes or due to pending deletion operations. The filesystem maintenance tool must carefully walk these linked structures to ensure data integrity, identify orphaned files, and reclaim resources. However, the original traversal algorithm failed to adequately handle cases where the internal pointers of an unlinked inode list formed a circular reference rather than terminating in a null pointer as expected for valid singly-linked lists.
This structural defect leads directly to a livelock condition within the scrubbing process. A livelock is distinct from a deadlock in that the involved processes are not blocked but continue executing without making progress, often consuming significant CPU resources indefinitely. When xfs_scrub encounters an unlinked inode list containing a loop, it enters an infinite traversal cycle because the termination condition based on reaching a null pointer or a specific end-of-list marker is never met. This results in the scrubbing operation hanging permanently, effectively causing a denial of service for any system administrator attempting to perform online consistency checks. In severe cases, this can lead to high CPU utilization and potential instability if other kernel subsystems depend on the completion of these maintenance tasks or if user-space tools waiting for the check to finish are left in an uninterruptible state.
The root cause of this issue lies in the absence of cycle detection logic during the traversal of unlinked inode chains. Standard linked list algorithms assume acyclic structures, relying on null terminators to signal completion. In XFS, due to concurrent modifications or specific failure modes where metadata corruption occurs, these lists can become circular. Without a mechanism to track visited nodes, the algorithm cannot distinguish between new inodes and those already processed within the current traversal path. This oversight represents a classic implementation error where input validation for structural integrity is insufficient during runtime operations that assume well-formed data structures.
To resolve this vulnerability, developers implemented a cycle detection strategy using a bitmap or similar tracking structure to record visited inode numbers during the scrubbing process. By maintaining a set of inodes already encountered within the current unlinked list traversal, the algorithm can immediately identify when it revisits an inode that is part of the active path, thereby detecting the loop and terminating the operation safely rather than continuing into infinite recursion or iteration. This fix ensures that even if metadata corruption results in circular references, the scrubbing tool will fail gracefully with a clear indication of inconsistency rather than hanging indefinitely.
From a security perspective, this vulnerability aligns with CWE-835, which describes loops involving resource synchronization where an operation can be trapped in an infinite loop due to lack of proper termination conditions or state tracking. It also relates to CWE-617 regarding reachability of critical variables if the livelock prevents other system functions from accessing necessary resources. In terms of the MITRE ATT&CK framework, while this is primarily a stability and reliability issue rather than an exploit vector for unauthorized access, it falls under techniques related to resource exhaustion or denial of service through software faults. An attacker with local access could potentially trigger this condition by crafting specific file system states that induce circular unlinked lists, thereby causing the scrubbing process to consume all available CPU cycles on a targeted core, leading to a localized denial of service.
Mitigation strategies for systems running affected versions of the Linux kernel involve applying the upstream patch that introduces bitmap-based cycle detection in the XFS scrub code path. System administrators should ensure their kernels are updated to include this fix before performing online file system checks. Additionally, it is advisable to monitor CPU usage during fsck operations on large or heavily modified filesystems where metadata corruption might be prevalent. Regular integrity checks using offline modes when possible can reduce the risk of encountering such live traversal issues, although the primary defense remains patching the kernel to handle malformed unlinked lists gracefully through explicit cycle detection mechanisms.