CVE-2026-80531

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80531", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.764Z", "datePublished": "2026-08-26T14:37:08.594Z", "dateUpdated": "2026-08-27T05:01:25.229Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:25.229Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: avoid UAF on sc->tempip in xrep_tempfile_create\n\nLOLLM noticed a potential UAF if the tempfile creation code fails after\nit set sc->tempip. Fix that."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is only reachable via XFS_IOC_SCRUB_METADATA or XFS_IOC_SCRUBV_METADATA ioctl on an open XFS file descriptor (xfs_file_ioctl -> xfs_ioc_scrub_metadata -> xfs_scrub_metadata -> xrep_setup_* -> xrep_tempfile_create); it is not exposed through NFS, SMB, or other network-facing kernel services.\nAC:L - An attacker with ioctl access can deterministically hit the error path by invoking online repair (XFS_SCRUB_IFLAG_REPAIR) and forcing tempfile creation to fail after xfs_icreate sets sc->tempip (e.g., ENOSPC from filling the filesystem or EIO), without races or uncontrollable victim state.\nPR:L - Both scrub ioctl handlers enforce capable(CAP_SYS_ADMIN), which is obtainable by unprivileged users who map root in a user namespace and mount their own XFS filesystem to run online scrub/repair, consistent with other XFS scrub CVE scoring.\nUI:N - Exploitation requires no victim interaction; the attacker issues the scrub/repair ioctl themselves once they have the required privileges and can induce the tempfile-creation failure.\nS:U - Impact is kernel memory corruption and crash within the same kernel security domain during XFS online repair teardown; this does not cross VM, container, or IOMMU security boundaries.\nC:H - On failure after sc->tempip is set, xrep_tempfile_create releases the inode but left a dangling pointer; xchk_teardown then calls xrep_tempfile_rele which performs xfs_is_metadir_inode, xfs_iunlock, and xchk_irele on freed xfs_inode memory\u2014a use-after-free enabling arbitrary kernel read.\nI:H - The stale sc->tempip is dereferenced in xrep_tempfile_rele for locking, metadir cleanup, and inode release on freed memory; UAF on xfs_inode structures can corrupt heap metadata and be leveraged for arbitrary kernel write or control-flow hijacking.\nA:H - Use-after-free on sc->tempip during xchk_teardown provokes double-free, invalid inode lock operations, or kernel oops/panic when online repair setup fails after partial tempfile creation, causing complete host denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/scrub/tempfile.c"], "versions": [{"version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "lessThan": "08a20776ce33a2a52d856911e447c59424f0465a", "status": "affected", "versionType": "git"}, {"version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "lessThan": "cd1f876d1bc2e94f271e07c606cacd85b109108a", "status": "affected", "versionType": "git"}, {"version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "lessThan": "96246a3200d32a43766152e56bc7ae2d93604d74", "status": "affected", "versionType": "git"}, {"version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "lessThan": "0c88e10d12de9ca7cbed1467bb1b52310101bff8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/scrub/tempfile.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/08a20776ce33a2a52d856911e447c59424f0465a"}, {"url": "https://git.kernel.org/stable/c/cd1f876d1bc2e94f271e07c606cacd85b109108a"}, {"url": "https://git.kernel.org/stable/c/96246a3200d32a43766152e56bc7ae2d93604d74"}, {"url": "https://git.kernel.org/stable/c/0c88e10d12de9ca7cbed1467bb1b52310101bff8"}], "title": "xfs: avoid UAF on sc->tempip in xrep_tempfile_create", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/xfs/scrub/tempfile.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "08a20776ce33a2a52d856911e447c59424f0465a", "status": "affected", "version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "versionType": "git"}, {"lessThan": "cd1f876d1bc2e94f271e07c606cacd85b109108a", "status": "affected", "version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "versionType": "git"}, {"lessThan": "96246a3200d32a43766152e56bc7ae2d93604d74", "status": "affected", "version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "versionType": "git"}, {"lessThan": "0c88e10d12de9ca7cbed1467bb1b52310101bff8", "status": "affected", "version": "84c14ee39dd388d73054181c70b3f42af7ddc238", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/xfs/scrub/tempfile.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: avoid UAF on sc->tempip in xrep_tempfile_create\n\nLOLLM noticed a potential UAF if the tempfile creation code fails after\nit set sc->tempip. Fix that."}], "id": "CVE-2026-80531", "lastModified": "2026-08-27T06:17:33.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:17:07.140", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08a20776ce33a2a52d856911e447c59424f0465a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c88e10d12de9ca7cbed1467bb1b52310101bff8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96246a3200d32a43766152e56bc7ae2d93604d74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd1f876d1bc2e94f271e07c606cacd85b109108a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xfs: avoid UAF on sc->tempip in xrep_tempfile_create", "id": "2524451", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524451"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the xfs filesystem component of the Linux kernel. This vulnerability is a Use-After-Free (UAF) issue, which means that the system attempts to use memory after it has been freed, potentially leading to unpredictable behavior. This specific UAF occurs during the creation of temporary files if an error occurs after a memory address has been assigned. An attacker could potentially exploit this flaw to cause a system crash (Denial of Service) or, in more severe scenarios, execute unauthorized code."], "name": "CVE-2026-80531", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80531\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80531\nhttps://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80531-36dd@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84c14ee39dd388d73054181c70b3f42af7ddc238,08a20776ce33a2a52d856911e447c59424f0465a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84c14ee39dd388d73054181c70b3f42af7ddc238,cd1f876d1bc2e94f271e07c606cacd85b109108a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84c14ee39dd388d73054181c70b3f42af7ddc238,96246a3200d32a43766152e56bc7ae2d93604d74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84c14ee39dd388d73054181c70b3f42af7ddc238,0c88e10d12de9ca7cbed1467bb1b52310101bff8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.105,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.46,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T15:45:04.430646+00:00", "updated": "2026-08-27T10:45:17.065234+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}