CVE-2026-80532

xfs: fix another iunlink infinite loop bug in online fsck

Published Aug 26, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix another iunlink infinite loop bug in online fsck

xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the
incore prev and next unlinked list pointers based on what it finds on
disk and in memory before we move on to relinking the truly lost inodes
back into the unlinked list. However, it's still vulnerable to infinite
loops that come in via the next_unlinked pointers.

Fix this problem by remembering which inodes we've already seen and
checking new agino pointers against that. If a bit is already set,
either this is a loop or the inode has nonzero link count. We'll deal
with the second case in a subsequent patch.

Analysis

Technical impact

The Linux kernel contains a flaw in the XFS filesystem online check that can cause an infinite loop during inode unlink processing. The bug arises because previously seen inodes are not tracked, leading the linked list traversal to repeat indefinitely. If this loop occurs, the filesystem check will hang, potentially exhausting CPU or memory resources and interrupting normal system operation. The impact is a loss of availability for the affected filesystem, as the online fsck cannot complete and may require a reboot or manual intervention.

Affected Systems

All Linux distributions that include the Linux kernel with an XFS filesystem support, prior to the inclusion of the patch that records visited inodes during online fsck. The exact kernel versions are not enumerated in the advisory, so any kernel offering XFS online check before the commit fixing this issue is considered affected.

Risk and Exploitability

The CVSS score of 5.5 indicates a medium severity. The vulnerability lacks an EPSS score and is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited in the wild. However, an attacker with local or privileged access could trigger a denial of service by initiating an online fsck on a filesystem that experiences this loop. Without the patch, the loop can persist indefinitely, causing prolonged downtime. The exact difficulty of exploitation depends on the ability to run an online fsck, which typically requires root privileges, making the risk higher for systems with misconfigured sudo or similar privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ab97f4b1c030750f2475bf4da8a9554d02206640`	affected	< 24aec8c88539a382355761a9b924046885b6be40
`ab97f4b1c030750f2475bf4da8a9554d02206640`	affected	< b6baf0db357fb84f3f3cfd33383a00de71a5a1c3
`ab97f4b1c030750f2475bf4da8a9554d02206640`	affected	< 23690064f235a88a00c04f2e49f36bfb54ae560d
`ab97f4b1c030750f2475bf4da8a9554d02206640`	affected	< 6d67c6b99f1fc07c64b97fcbc974c6f1ada7f622

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[ab97f4b1c030750f2475bf4da8a9554d02206640,24aec8c88539a382355761a9b924046885b6be40)`	affected	code_commit	—
`[ab97f4b1c030750f2475bf4da8a9554d02206640,b6baf0db357fb84f3f3cfd33383a00de71a5a1c3)`	affected	code_commit	—
`[ab97f4b1c030750f2475bf4da8a9554d02206640,23690064f235a88a00c04f2e49f36bfb54ae560d)`	affected	code_commit	—
`[ab97f4b1c030750f2475bf4da8a9554d02206640,6d67c6b99f1fc07c64b97fcbc974c6f1ada7f622)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the commit fixing the inode unlink loop in XFS online fsck.
Avoid running online XFS filesystem checks until the kernel has been updated, or perform checks offline to prevent triggering the infinite loop.
Ensure regular kernel updates are applied to all systems to prevent reintroduction of the flaw.

Generated by OpenCVE AI on August 27, 2026 at 01:36 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4788-1	linux-6.12 security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.168% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/23690064f235a88a00c04f2e49f36bfb54ae560d
https://git.kernel.org/stable/c/24aec8c88539a382355761a9b924046885b6be40
https://git.kernel.org/stable/c/6d67c6b99f1fc07c64b97fcbc974c6f1ada7f622
https://git.kernel.org/stable/c/b6baf0db357fb84f3f3cfd33383a00de71a5a1c3
https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80532-6860@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80532
https://www.cve.org/CVERecord?id=CVE-2026-80532

History

Aug 27, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80532-6860@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80532 https://www.cve.org/CVERecord?id=CVE-2026-80532
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Aug 26, 2026 5:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-665

Aug 26, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it finds on disk and in memory before we move on to relinking the truly lost inodes back into the unlinked list. However, it's still vulnerable to infinite loops that come in via the next_unlinked pointers. Fix this problem by remembering which inodes we've already seen and checking new agino pointers against that. If a bit is already set, either this is a loop or the inode has nonzero link count. We'll deal with the second case in a subsequent patch.
Title		xfs: fix another iunlink infinite loop bug in online fsck
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/23690064f235a88a00c04f2e49f36bfb54ae560d https://git.kernel.org/stable/c/24aec8c88539a382355761a9b924046885b6be40 https://git.kernel.org/stable/c/6d67c6b99f1fc07c64b97fcbc974c6f1ada7f622 https://git.kernel.org/stable/c/b6baf0db357fb84f3f3cfd33383a00de71a5a1c3