CVE-2026-80899 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
erofs: remove fscache backend entirely
EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a local filesystem and has an kernel-defined caching hierarchy which could be inflexible compared to the fanotify pre-content hooks. Therefore, this feature has been deprecated for almost two years.
As EROFS file-backed mounts and fanotify pre-content hooks both upstream for a while and already providing equivalent functionality (erofs-utils has supported fanotify pre-content hooks), let's remove the fscache backend now.
The main application of this feature is Nydus [1], and they plan to move
to use fanotify pre-content hooks in the near future too.
I hope this patch can be merged into Linux 7.2, which is also motivated by newly found implementation issues [2][3] that are not worth
investigating given the deprecation and limited development resources. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later: it seems fine since the codebase is isolated by CONFIG_CACHEFILES_ONDEMAND.
[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md
[2] https://github.com/dragonflyoss/nydus/pull/1824
[3] https://lore.kernel.org/r/[email protected]
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel has addressed a significant architectural shift within the EROFS filesystem by completely removing its fscache backend support, a change that resolves long-standing implementation issues and aligns with modern caching paradigms. This modification is not merely a code cleanup but represents a strategic deprecation of an outdated mechanism in favor of more robust and flexible alternatives provided by the fanotify pre-content hooks subsystem. The original introduction of EROFS over fscache was intended to facilitate image lazy pulling, allowing for on-demand retrieval of filesystem data from remote or cached sources without loading entire images into memory at once. However, as the kernel evolved, the underlying dependencies required to support this feature became increasingly burdensome and misaligned with the operational model of a local filesystem. Specifically, the fscache subsystem began requiring netfs as a hard dependency, introducing complexity that was unnecessary for EROFS operations which primarily interact with local storage rather than network file systems.
The technical flaw in retaining the old architecture lies in its rigidity and the introduction of kernel-defined caching hierarchies that do not scale well or adapt easily to diverse deployment scenarios. This inflexibility contrasts sharply with the capabilities offered by fanotify pre-content hooks, which provide a more granular and efficient mechanism for handling content retrieval on demand. The fanotify approach allows applications like Nydus to intercept file access events and fetch data only when strictly necessary, bypassing the overhead and constraints imposed by the fscache subsystem. This transition addresses implementation issues that have persisted since the feature's introduction, including potential race conditions and resource management inefficiencies that were deemed too costly to fix given the impending obsolescence of the old method. By removing this backend, the kernel eliminates these latent vulnerabilities associated with complex state management in caching layers, thereby reducing the attack surface related to improper synchronization or memory corruption within the fscache integration points.
From an operational impact perspective, this change enhances system stability and performance for users relying on EROFS for container images and read-only filesystems. The removal ensures that developers no longer need to maintain compatibility with a deprecated subsystem, reducing technical debt and potential bugs arising from outdated code paths. For organizations using Nydus or similar technologies, the migration to fanotify pre-content hooks offers improved reliability and performance characteristics, as these hooks are better integrated into the VFS layer and do not suffer from the same dependency constraints. This shift also simplifies the kernel configuration space by removing conditional compilation flags related to fscache support for EROFS, leading to a cleaner codebase that is easier to audit and maintain. The associated cleanup of fscache and cachefiles components will follow separately through the VFS tree, ensuring that no residual dependencies or dangling references remain in the kernel source.
This vulnerability resolution aligns with industry standards regarding secure software lifecycle management and architectural modernization. While not a traditional CVE involving direct exploitation by an attacker, it addresses CWE-1059: Insufficient Documentation of Security Design Decisions by formally retiring a complex subsystem that posed maintenance risks. Furthermore, the move to fanotify hooks supports better adherence to principles found in MITRE ATT&CK regarding reducing attack surfaces through simplification and removal of unnecessary components. By eliminating the fscache backend, the kernel reduces potential vectors for vulnerabilities related to improper resource handling or logic errors in caching mechanisms. Security teams should ensure that their environments are updated to utilize the fanotify-based approach if they rely on EROFS with lazy pulling capabilities, verifying that applications like Nydus have been upgraded to support these newer hooks. This transition underscores the importance of regularly reviewing and retiring deprecated features to maintain a secure and efficient kernel environment.