CVE-2026-80534

xfs: fix ilock leak on error in xfs_dq_get_next_id

Published Aug 26, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix ilock leak on error in xfs_dq_get_next_id

xfs_dq_get_next_id() takes the quota inode ILOCK before calling
xfs_iread_extents(). If xfs_iread_extents() fails, the function returns
immediately without releasing the lock, leaking the quota inode ILOCK.
This can leave the quota inode locked and cause subsequent quota
operations to hang.

Fix this by jumping to a common unlock path on error instead of returning
directly.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< e4c05ebd01e910bccd4f7e9517c7353982e27763
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< 6401b99a285cd4cfb2949ba44675541b91ad7e4f
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< 0865e4fca02e418fd2423fae9a887dee87b778a1
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< ed8bfb43de71213cfdbbe833b2c2817250e18b1a
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< e270d539b8a2e0cb8f617fee47a7b083c0088361
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< 514a5d42d4188fc5f1499a8d654c717ebf981193
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< 08bed2b67d2ee79d3e138c344d8dcfa4c9b26a38
`bda250dbaf39f67f8910e183853e4e6a9e5ce899`	affected	< 63320a0f70f66f311f4bccff3af0719c2119f46c

Linux

affected

Version	Status	Constraints
`4.13`	affected	—
`0`	unaffected	< 4.13
`5.10.267`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[bda250dbaf39f67f8910e183853e4e6a9e5ce899,6401b99a285cd4cfb2949ba44675541b91ad7e4f)`	affected	code_commit	—
`[bda250dbaf39f67f8910e183853e4e6a9e5ce899,0865e4fca02e418fd2423fae9a887dee87b778a1)`	affected	code_commit	—
`[bda250dbaf39f67f8910e183853e4e6a9e5ce899,ed8bfb43de71213cfdbbe833b2c2817250e18b1a)`	affected	code_commit	—
`[bda250dbaf39f67f8910e183853e4e6a9e5ce899,e270d539b8a2e0cb8f617fee47a7b083c0088361)`	affected	code_commit	—
`[bda250dbaf39f67f8910e183853e4e6a9e5ce899,514a5d42d4188fc5f1499a8d654c717ebf981193)`	affected	code_commit	—
`[bda250dbaf39f67f8910e183853e4e6a9e5ce899,08bed2b67d2ee79d3e138c344d8dcfa4c9b26a38)`	affected	code_commit	—
`[bda250dbaf39f67f8910e183853e4e6a9e5ce899,63320a0f70f66f311f4bccff3af0719c2119f46c)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.13`	affected	semver	—
`[0,4.13)`	unaffected	semver	—
`[5.15.217,5.16.0)`	unaffected	semver	—
`[6.1.184,6.2.0)`	unaffected	semver	—
`[6.6.153,6.7.0)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.177% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/0865e4fca02e418fd2423fae9a887dee87b778a1
https://git.kernel.org/stable/c/08bed2b67d2ee79d3e138c344d8dcfa4c9b26a38
https://git.kernel.org/stable/c/514a5d42d4188fc5f1499a8d654c717ebf981193
https://git.kernel.org/stable/c/63320a0f70f66f311f4bccff3af0719c2119f46c
https://git.kernel.org/stable/c/6401b99a285cd4cfb2949ba44675541b91ad7e4f
https://git.kernel.org/stable/c/e270d539b8a2e0cb8f617fee47a7b083c0088361
https://git.kernel.org/stable/c/e4c05ebd01e910bccd4f7e9517c7353982e27763
https://git.kernel.org/stable/c/ed8bfb43de71213cfdbbe833b2c2817250e18b1a
https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80534-b7cd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80534
https://www.cve.org/CVERecord?id=CVE-2026-80534

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 27, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/e4c05ebd01e910bccd4f7e9517c7353982e27763

Aug 27, 2026 2:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-689

Aug 27, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80534-b7cd@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80534 https://www.cve.org/CVERecord?id=CVE-2026-80534
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Aug 26, 2026 4:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-689

Aug 26, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfs_dq_get_next_id xfs_dq_get_next_id() takes the quota inode ILOCK before calling xfs_iread_extents(). If xfs_iread_extents() fails, the function returns immediately without releasing the lock, leaking the quota inode ILOCK. This can leave the quota inode locked and cause subsequent quota operations to hang. Fix this by jumping to a common unlock path on error instead of returning directly.
Title		xfs: fix ilock leak on error in xfs_dq_get_next_id
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0865e4fca02e418fd2423fae9a887dee87b778a1 https://git.kernel.org/stable/c/08bed2b67d2ee79d3e138c344d8dcfa4c9b26a38 https://git.kernel.org/stable/c/514a5d42d4188fc5f1499a8d654c717ebf981193 https://git.kernel.org/stable/c/63320a0f70f66f311f4bccff3af0719c2119f46c https://git.kernel.org/stable/c/6401b99a285cd4cfb2949ba44675541b91ad7e4f https://git.kernel.org/stable/c/e270d539b8a2e0cb8f617fee47a7b083c0088361 https://git.kernel.org/stable/c/ed8bfb43de71213cfdbbe833b2c2817250e18b1a