{"id":"CVE-2026-80536","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: bounds-check buffer log item's dirty bitmap\n\nxlog_recover_do_reg_buffer() replays each dirty region described by a\nbuffer log item's bitmap into the buffer read fo…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: bounds-check buffer log item's dirty bitmap\n\nxlog_recover_do_reg_buffer() replays each dirty region described by a\nbuffer log item's bitmap into the buffer read fo…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux 9","10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_nfv_v_8","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_rt_v_8","enterprise_linux_real_time_v_9"],"patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_nfv_v_8","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_rt_v_8","enterprise_linux_real_time_v_9"],"published":"2026-08-26","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:58.070","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80536","references":[{"url":"https://git.kernel.org/stable/c/7e32d4eebae6ca24f8a673c107fd7eca1f47afc2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/813f8136a2ce1fee266d02a7df73db6e8a541604","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/acb4e26295e7f0e685815a3fd3d70bd8329cefa1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7528b42813f02724a78fce1da24d69d1bfc4d38","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/edaf5b6bd625356893da20d69a259b34a9de2694","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3859c35a4fbc1c1c58431f684f808e43696891d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7b5fa83e2c192be922121b764415fa8c7549ea1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8288214459ead7e87d26e5822f62c14a4f2ed6b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80536.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80536"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524501"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80536"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80536"},{"url":"https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80536-5666@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:88477"},{"url":"https://access.redhat.com/errata/RHSA-2026:87805"},{"url":"https://access.redhat.com/errata/RHSA-2026:87375"},{"url":"https://access.redhat.com/errata/RHSA-2026:87374"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00142,"epssPercentile":0.03451,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:16:45.666700Z"},"scores":{"nvd":8.4,"vendor":7.8,"cna":8.4},"ingestedAt":"2026-10-16T19:46:24.320Z","slug":"CVE-2026-80536","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: bounds-check buffer log item's dirty bitmap\n\nxlog_recover_do_reg_buffer() replays each dirty region described by a\nbuffer log item's bitmap into the buffer read for that item:\n\n\tmemcpy(xfs_buf_offset(bp, (uint)bit << XFS_BLF_SHIFT),\n\t\titem->ri_buf[i].iov_base,\n\t\tnbits << XFS_BLF_SHIFT);\n\nThe destination offset (bit/nbits, from the logged dirty bitmap) and the\nbuffer size (from the logged blf_len) are both attacker-controlled and\notherwise unrelated, yet the only thing bounding the copy is an ASSERT(),\nwhich compiles away on production kernels. A crafted image logging a\nsmall blf_len together with a bitmap bit past the end of that buffer\ndrives the memcpy() past the buffer's allocation, corrupting adjacent\nkernel heap during mount-time log recovery. This is reachable by anyone\nwho can get a crafted image mounted -- the malicious-filesystem threat\nmodel XFS already guards against elsewhere.\n\nTurn the ASSERT() into a real XFS_IS_CORRUPT() check that aborts recovery\nof the buffer with -EFSCORRUPTED, consistent with the validate-and-fail\nidiom already used in xlog_recover_do_inode_buffer() and\nxfs_dquot_item_recover.c. xlog_recover_do_reg_buffer() therefore becomes\nSTATIC int and its three callers propagate the error.\n\nFound and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build: the crafted\nimage trips a slab-out-of-bounds write before this change and fails\nrecovery cleanly with -EFSCORRUPTED after it.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:88477** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88477)\n- **RHSA-2026:87805** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:87805)\n- **RHSA-2026:87375** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87375)\n- **RHSA-2026:87374** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87374)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80536.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230415,"id":"CVE-2026-80536","ts":1793134641663,"field":"cvss","old":"7.8","new":"8.4"},{"seq":228176,"id":"CVE-2026-80536","ts":1792758155347,"field":"cvss","old":"8.4","new":"7.8"}]}