CVE-2026-80529

A flaw was found in the Linux kernel's XFS filesystem. During dquot recovery, the xlogrecoverdquotcommitpass2 function fails to correctly propagate verification errors. This allows a corrupt quota buffer to be written back to disk, potentially leading to data corruption within the XFS filesystem...

CVE-2026-80530

A flaw was found in the Linux kernel's XFS filesystem. When performing file range exchanges with the XFSEXCHMAPSINO1WRITTEN flag set, the reflink flag can be prematurely cleared from an inode that still manages shared written data. This can lead to data corruption between files that share data...

CVE-2026-80533

A flaw was found in the Linux kernel's XFS filesystem. This vulnerability occurs during the Allocation Group Information AGI repair process, specifically in the xrepiunlinkwalkondiskbucket function. If the buffer verifier fails, a null pointer dereference can occur when attempting to rebuild...

CVE-2026-80532

A flaw was found in the XFS filesystem's online file system check fsck utility within the Linux kernel. The xrepiunlinkresolvebucket function, responsible for reconstructing unlinked inode lists, is vulnerable to an infinite loop. This can occur due to malformed nextunlinked pointers, potentially...

CVE-2026-80534

A flaw was found in the XFS filesystem component of the Linux kernel. The xfsdqgetnextid function fails to release an inode lock ilock if an error occurs during extent reading. This ilock leak can leave the quota inode permanently locked, preventing further quota operations and leading to a denia...

CVE-2026-80535

A flaw was found in the Linux kernel's XFS filesystem. When a local user or process attempts to delete a directory that refers to itself, the directory tree repair code incorrectly tries to acquire a lock on the same inode twice. This double-locking issue can lead to system instability or...

CVE-2026-80536

A flaw was found in the Linux kernel's XFS filesystem. A local attacker, by mounting a specially crafted XFS image, could trigger an out-of-bounds write during log recovery. This vulnerability allows for kernel heap corruption, which could lead to a denial of service or potentially arbitrary code...

CVE-2026-80537

A flaw was found in the Linux kernel's XFS filesystem. An off-by-one error in the rtrefcount btree root level validation allows a local attacker to craft a malicious XFS image. When this image is mounted, it can lead to a slab-out-of-bounds write, causing a kernel panic and a denial of service Do...

CVE-2026-80538

A flaw was found in the XFS filesystem within the Linux kernel. The xfsrtginodeensure function incorrectly handles errors returned by xfsrtginodeload, treating I/O, allocation, or corruption errors as successful operations. This oversight can result in the realtime group inode remaining unset,...

CVE-2026-80531

A flaw was found in the xfs filesystem component of the Linux kernel. This vulnerability is a Use-After-Free UAF issue, which means that the system attempts to use memory after it has been freed, potentially leading to unpredictable behavior. This specific UAF occurs during the creation of...

K000163112: Linux kernel vulnerability CVE-2026-64600

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfsreflinkfillcowhole,delalloc are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers...

CVE-2026-80538

In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfsrtginodeload xfsrtginodeensure treats every xfsrtginodeload error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs th...

CVE-2026-80537

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-80531

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-80533

In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a null sc-sa.agibp in AGI repair LOLLM noticed a longstanding bug where xrepiunlinkwalkondiskbucket tries to walk ragi-sc-sa.agibp to rebuild the unlinked inode lists. Unfortunately, it's possible f...

CVE-2026-80532

In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrepiunlinkresolvebucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it finds on disk and in memory before we move ...

CVE-2026-80535

In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this case, it's not correct for the directory tree repair code to try to...

AZL-97851 CVE-2026-80536 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpyxfsbufoffsetbp, uintbit ribufi.iovbase, nbits...

CVE-2026-80536

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpyxfsbufoffsetbp, uintbit ribufi.iovbase, nbits...

CVE-2026-80534

In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, leaking the quota...