--- id: CVE-2026-80536 title: |- In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read fo… summary: |- In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read fo… severity: high cvss: 8.4 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-787 vendor: Red Hat product: Red Hat Enterprise Linux BaseOS (v. 10) affected: - enterprise_linux 9 - 10base_smtv - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_hidden_v_10 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_nfv_v_8 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_v_10 - enterprise_linux_rt_v_8 - enterprise_linux_real_time_v_9 patched: - 10base_smtv - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_hidden_v_10 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_nfv_v_8 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_v_10 - enterprise_linux_rt_v_8 - enterprise_linux_real_time_v_9 published: '2026-08-26' updated: '2026-10-16' sourceUpdated: '2026-10-16T20:17:58.070' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80536' references: - url: 'https://git.kernel.org/stable/c/7e32d4eebae6ca24f8a673c107fd7eca1f47afc2' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/813f8136a2ce1fee266d02a7df73db6e8a541604' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/acb4e26295e7f0e685815a3fd3d70bd8329cefa1' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/b7528b42813f02724a78fce1da24d69d1bfc4d38' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/edaf5b6bd625356893da20d69a259b34a9de2694' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f3859c35a4fbc1c1c58431f684f808e43696891d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f7b5fa83e2c192be922121b764415fa8c7549ea1' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f8288214459ead7e87d26e5822f62c14a4f2ed6b' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80536.json - url: 'https://access.redhat.com/security/cve/CVE-2026-80536' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2524501' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80536' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80536' - url: >- https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80536-5666@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:88477' - url: 'https://access.redhat.com/errata/RHSA-2026:87805' - url: 'https://access.redhat.com/errata/RHSA-2026:87375' - url: 'https://access.redhat.com/errata/RHSA-2026:87374' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.00142 epssPercentile: 0.03451 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T19:16:45.666700Z' scores: nvd: 8.4 vendor: 7.8 cna: 8.4 ingestedAt: '2026-10-16T19:46:24.320Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_buf_offset(bp, (uint)bit << XFS_BLF_SHIFT), item->ri_buf[i].iov_base, nbits << XFS_BLF_SHIFT); The destination offset (bit/nbits, from the logged dirty bitmap) and the buffer size (from the logged blf_len) are both attacker-controlled and otherwise unrelated, yet the only thing bounding the copy is an ASSERT(), which compiles away on production kernels. A crafted image logging a small blf_len together with a bitmap bit past the end of that buffer drives the memcpy() past the buffer's allocation, corrupting adjacent kernel heap during mount-time log recovery. This is reachable by anyone who can get a crafted image mounted -- the malicious-filesystem threat model XFS already guards against elsewhere. Turn the ASSERT() into a real XFS_IS_CORRUPT() check that aborts recovery of the buffer with -EFSCORRUPTED, consistent with the validate-and-fail idiom already used in xlog_recover_do_inode_buffer() and xfs_dquot_item_recover.c. xlog_recover_do_reg_buffer() therefore becomes STATIC int and its three callers propagate the error. Found and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build: the crafted image trips a slab-out-of-bounds write before this change and fails recovery cleanly with -EFSCORRUPTED after it. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:88477** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88477) - **RHSA-2026:87805** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:87805) - **RHSA-2026:87375** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87375) - **RHSA-2026:87374** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87374) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80536.json)