CVE-2026-80697

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80697", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.786Z", "datePublished": "2026-08-28T06:53:02.236Z", "dateUpdated": "2026-08-28T12:08:17.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-28T12:08:17.218Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: ensure valid f_path for page cache sharing\n\nPreviously, backing files for page cache sharing were set up with\nf_path left as NULL (only f_inode was valid). It worked, but a recent\nmincore fix relies on f_path.mnt and crashes (found by \"erofs/028\" on\n7.2-rc4):\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP PTI\n CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)\n Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\n RIP: 0010:__do_sys_mincore+0xc0/0x2c0\n ...\n\nSpecify valid paths using valid disconnected dentries together with\nerofs_ishare_mnt instead of leaving f_path empty, so they are more\nlike real backing files in a pseudo filesystem and standard\nbacking_file_open() can be used directly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/Kconfig", "fs/erofs/internal.h", "fs/erofs/ishare.c"], "versions": [{"version": "5ef3208e3be50aa08b4e7a2832f34e16d42c08b3", "lessThan": "3879657c4ffd81b9a42cf575fc6cb60201032587", "status": "affected", "versionType": "git"}, {"version": "5ef3208e3be50aa08b4e7a2832f34e16d42c08b3", "lessThan": "96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/Kconfig", "fs/erofs/internal.h", "fs/erofs/ishare.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3879657c4ffd81b9a42cf575fc6cb60201032587"}, {"url": "https://git.kernel.org/stable/c/96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443"}], "title": "erofs: ensure valid f_path for page cache sharing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/erofs/Kconfig", "fs/erofs/internal.h", "fs/erofs/ishare.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3879657c4ffd81b9a42cf575fc6cb60201032587", "status": "affected", "version": "5ef3208e3be50aa08b4e7a2832f34e16d42c08b3", "versionType": "git"}, {"lessThan": "96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443", "status": "affected", "version": "5ef3208e3be50aa08b4e7a2832f34e16d42c08b3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/erofs/Kconfig", "fs/erofs/internal.h", "fs/erofs/ishare.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: ensure valid f_path for page cache sharing\n\nPreviously, backing files for page cache sharing were set up with\nf_path left as NULL (only f_inode was valid). It worked, but a recent\nmincore fix relies on f_path.mnt and crashes (found by \"erofs/028\" on\n7.2-rc4):\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP PTI\n CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)\n Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\n RIP: 0010:__do_sys_mincore+0xc0/0x2c0\n ...\n\nSpecify valid paths using valid disconnected dentries together with\nerofs_ishare_mnt instead of leaving f_path empty, so they are more\nlike real backing files in a pseudo filesystem and standard\nbacking_file_open() can be used directly."}], "id": "CVE-2026-80697", "lastModified": "2026-08-28T16:18:28.657", "metrics": {}, "published": "2026-08-28T08:16:55.187", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3879657c4ffd81b9a42cf575fc6cb60201032587"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: erofs: ensure valid f_path for page cache sharing", "id": "2525372", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525372"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nerofs: ensure valid f_path for page cache sharing\nPreviously, backing files for page cache sharing were set up with\nf_path left as NULL (only f_inode was valid). It worked, but a recent\nmincore fix relies on f_path.mnt and crashes (found by \"erofs/028\" on\n7.2-rc4):\nBUG: kernel NULL pointer dereference, address: 0000000000000018\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP PTI\nCPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)\nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\nRIP: 0010:__do_sys_mincore+0xc0/0x2c0\n...\nSpecify valid paths using valid disconnected dentries together with\nerofs_ishare_mnt instead of leaving f_path empty, so they are more\nlike real backing files in a pseudo filesystem and standard\nbacking_file_open() can be used directly.", "A flaw was found in the Linux kernel's erofs filesystem. An invalid `f_path` for page cache sharing could lead to a null pointer dereference when a `mincore` operation is performed. This vulnerability could allow a local attacker to cause a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-80697", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80697\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80697\nhttps://lore.kernel.org/linux-cve-announce/2026082805-CVE-2026-80697-4e8a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04ba248d02d9eaa3d9077b00a6134caa75fa3e90,3879657c4ffd81b9a42cf575fc6cb60201032587)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e187bc02f8fa4226d62814592cf064ee4557c470,96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "7368bec565bac3e536cd43579dbde1e715e6ba61"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "744b23aa430d52f5c8e4dbff7d71496d6643bed2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8344bdf0629457e532797b42d9d2bbf2a2900bbf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5c942ad7df75925ee166e7f0fb36892d8dde376b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.217,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.184,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.4,7.1.8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T10:45:04.386787+00:00", "updated": "2026-08-31T14:30:09.004455+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}