CVE-2026-80808: ext4: stop retrying saturated xattr cache entries

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: stop retrying saturated xattr cache entries

ext4_xattr_block_set() retries when a cache entry selected for reuse
has a saturated reference count after taking the buffer lock. The retry
returns to the mbcache lookup without making that entry ineligible, so
it can select the same unusable entry indefinitely. A task spinning
there can hold the parent directory's i_rwsem and leave concurrent
rmdir callers blocked.

Normally a reusable entry has a reference count below
EXT4_XATTR_REFCOUNT_MAX because the count and MBE_REUSABLE_B are
updated under the same buffer lock. A corrupted filesystem can violate
that invariant. The syzbot reproducer reports allocator and xattr
corruption before triggering this retry loop.

Check the untrusted on-disk count before incrementing it, avoiding
overflow, and clear MBE_REUSABLE_B when it is already saturated. The
next lookup then skips the entry that was just proven unusable. This
mirrors the normal transition at EXT4_XATTR_REFCOUNT_MAX; the release
path marks the entry reusable again on the exact 1024-to-1023
transition.

Using the same QEMU harness and guest parameters, current unpatched
Linux hung in 6 of 8 420-second trials with the do_rmdir signature;
representative NMI backtraces caught the owner spinning in
ext4_xattr_block_set(). The patched kernel completed 28 of 28 trials
without a hung-task report; the final twelve trials exercised the
reviewed overflow-safe form of the change. syzbot's patch testing also
completed without reproducing the hang.

The Linux kernel CVE team has assigned CVE-2026-80808 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.163 with commit 1a56cd972ce121b6cf2517a47a578782bbd2ec95 and fixed in 5.10.267 with commit 119a2f053242ed75bdd2ebc95baf3ae7db6ccacf
	Issue introduced in 5.15.61 with commit 1be97463696c7291a3e1547614e96432b0bd3add and fixed in 5.15.218 with commit 61631352a5b405c89be579de00903b72e6888aa4
	Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.1.185 with commit 8865cd664484517703df5c18a965dc3227572b87
	Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.6.154 with commit a40c45268f4358207aa9c53764fed2e05f62986a
	Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.12.106 with commit 889ec86464d261f026f6c334040cfc6c58c99d58
	Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.18.47 with commit 4902a5cba21aeaf91e6b29e20e0967a5f6abdcd9
	Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 7.1.11 with commit 55ee6533c1db7f7656fa8dd19637f3f8b8c08dc5
	Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 7.2.1 with commit dbd4aea175ad3c46436acb251e817b4374628072
	Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 7.3-rc1 with commit 54b6bd40898de7906acb2bccc9a96d1b8e6b4323
	Issue introduced in 4.19.270 with commit 98953044b3cdb2cb7d82e7365b659e2ed4f4ca4d
	Issue introduced in 5.4.229 with commit af8ecc8d20e72130771cc076bce7fcf17ccda6c4
	Issue introduced in 5.18.18 with commit c6fac5cf5a5098732623bcd00a8a3eb9f5465144
	Issue introduced in 5.19.2 with commit 96fa141fa295ae9428da73c56c9852053b575c04

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80808
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/xattr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/119a2f053242ed75bdd2ebc95baf3ae7db6ccacf
	https://git.kernel.org/stable/c/61631352a5b405c89be579de00903b72e6888aa4
	https://git.kernel.org/stable/c/8865cd664484517703df5c18a965dc3227572b87
	https://git.kernel.org/stable/c/a40c45268f4358207aa9c53764fed2e05f62986a
	https://git.kernel.org/stable/c/889ec86464d261f026f6c334040cfc6c58c99d58
	https://git.kernel.org/stable/c/4902a5cba21aeaf91e6b29e20e0967a5f6abdcd9
	https://git.kernel.org/stable/c/55ee6533c1db7f7656fa8dd19637f3f8b8c08dc5
	https://git.kernel.org/stable/c/dbd4aea175ad3c46436acb251e817b4374628072
	https://git.kernel.org/stable/c/54b6bd40898de7906acb2bccc9a96d1b8e6b4323