CVE-2026-80531 - Vulnerability Details

- xfs: avoid UAF on sc->tempip in xrep_tempfile_create

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: avoid UAF on sc->tempip in xrep_tempfile_create

LOLLM noticed a potential UAF if the tempfile creation code fails after
it set sc->tempip. Fix that.

Published: 2026-08-26

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free occurs in the XFS filesystem when a temporary file is created and the sc->tempip pointer is set, but the creation subsequently fails and the pointer remains dangling. If the kernel later dereferences this freed memory, it can result in arbitrary code execution in kernel mode or cause the kernel to crash, thereby compromising system confidentiality, integrity, or availability.

Affected Systems

All Linux systems running a kernel version prior to the fixing commit are affected; the flaw resides in the XFS filesystem layer of the Linux kernel.

Risk and Exploitability

The CVSS score is 7.8, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require influencing filesystem operations to trigger the dangling pointer being dereferenced. No public exploits are known, but the potential for local privilege elevation or denial of service remains if the flaw is triggered.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`84c14ee39dd388d73054181c70b3f42af7ddc238`	affected	< 08a20776ce33a2a52d856911e447c59424f0465a
`84c14ee39dd388d73054181c70b3f42af7ddc238`	affected	< cd1f876d1bc2e94f271e07c606cacd85b109108a
`84c14ee39dd388d73054181c70b3f42af7ddc238`	affected	< 96246a3200d32a43766152e56bc7ae2d93604d74
`84c14ee39dd388d73054181c70b3f42af7ddc238`	affected	< 0c88e10d12de9ca7cbed1467bb1b52310101bff8

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[84c14ee39dd388d73054181c70b3f42af7ddc238,08a20776ce33a2a52d856911e447c59424f0465a)`	affected	code_commit	—
`[84c14ee39dd388d73054181c70b3f42af7ddc238,cd1f876d1bc2e94f271e07c606cacd85b109108a)`	affected	code_commit	—
`[84c14ee39dd388d73054181c70b3f42af7ddc238,96246a3200d32a43766152e56bc7ae2d93604d74)`	affected	code_commit	—
`[84c14ee39dd388d73054181c70b3f42af7ddc238,0c88e10d12de9ca7cbed1467bb1b52310101bff8)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	semver	—
`[0,6.10)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a release that contains the commit fixing the use‑after‑free in XFS.
Configure the affected XFS filesystem as read‑only or restrict write permissions to limit temporary file creation until the patch is applied.
Monitor the system for abnormal temporary file activity, unexpected kernel crashes, and investigate promptly if an anomaly is detected.

Generated by OpenCVE AI on August 27, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00128.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/08a20776ce33a2a52d856911e447c59424f0465a
https://git.kernel.org/stable/c/0c88e10d12de9ca7cbed1467bb1b52310101bff8
https://git.kernel.org/stable/c/96246a3200d32a43766152e56bc7ae2d93604d74
https://git.kernel.org/stable/c/cd1f876d1bc2e94f271e07c606cacd85b109108a
https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80531-36dd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80531
https://www.cve.org/CVERecord?id=CVE-2026-80531

History

Thu, 27 Aug 2026 09:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 27 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80531-36dd@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80531 https://www.cve.org/CVERecord?id=CVE-2026-80531
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 26 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc->tempip. Fix that.
Title		xfs: avoid UAF on sc->tempip in xrep_tempfile_create
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08a20776ce33a2a52d856911e447c59424f0465a https://git.kernel.org/stable/c/0c88e10d12de9ca7cbed1467bb1b52310101bff8 https://git.kernel.org/stable/c/96246a3200d32a43766152e56bc7ae2d93604d74 https://git.kernel.org/stable/c/cd1f876d1bc2e94f271e07c606cacd85b109108a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:08.594Z

Updated: 2026-08-27T05:01:25.229Z

Reserved: 2026-08-26T14:34:25.764Z

Link: CVE-2026-80531

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:07.140

Modified: 2026-08-27T06:17:33.500

Link: CVE-2026-80531

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80531 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-27T10:45:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object