From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A73631A065 for ; Fri, 4 Sep 2026 15:18:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535100; cv=none; b=epYYWj4hS4ldJlRiv4H9raMhY3sd4YwPfsC5K9Val0gb8YTzcbmrXZeex9W4QaYaRoam/uBevuw2VDJYfsZgmvdvVjK0wyka31ad2aR8c103OX3hVtDVZCFlG3QCqhNWQioogMCnBqrXvZPbU/1jArJCG1ptPt+wJQ61hFKIeAE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535100; c=relaxed/simple; bh=QZOr0Dw3OFQoHT9ZwknuytEvVGCohUcF3LeTcxZLiOE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GxyiiJb6Moxjq+TijUrbUdI7Vc0Tcm1pcNmGd4UyFtcGHdX2L5Bpii9vJU3aCtctEKrATqTPke3J4ZYX3CXu54INd5aubFVNC/FUpX0VQipfQyoKpz613n2jG8LsMLW8SyCbaqifiauO02SqnlbeKR5sH0uMbUqZfzt24wU4X1M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pGZY0whM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="pGZY0whM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B1541F00A3D; Fri, 4 Sep 2026 15:18:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788535098; bh=Sm/wdBsH5q3pIXaqZ92V0y5x8/Dz7bLdWLuc9dBgZ2k=; h=From:To:Cc:Subject:Date:Reply-To; b=pGZY0whM4f58w9RqDBhbGD/Tmc1KpJL2MRTotjyDxc81SDlyRTaJGP725XCESmCuj 6qg7t7rBxT+CK/wt2Bk2+xD5vI287NQnGT0vzHcWMPC2CyHRbKRQf+38Btch0IH8QX HY58K0ZnnlMgLTh5N4Txc//NsJzSxj/vwnkiwhqw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80808: ext4: stop retrying saturated xattr cache entries Date: Fri, 4 Sep 2026 17:11:47 +0200 Message-ID: <2026090410-CVE-2026-80808-8237@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5177; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=L6AJ1SjpCJ3qB2DuHlB3CtaAO/W29auCjiUbF/zlUvM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmz7vc9PBIuYSygzvn4iNLHNL9r7I22txbWzVYJ8Os79 Tq69XZgRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEykrI9hweml2WG2gasvu3z1 38KZ7/64I8P7IMN89y/79m3sVrq46pqMpb+QdffFLXJbAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4_xattr_block_set() retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without making that entry ineligible, so it can select the same unusable entry indefinitely. A task spinning there can hold the parent directory's i_rwsem and leave concurrent rmdir callers blocked. Normally a reusable entry has a reference count below EXT4_XATTR_REFCOUNT_MAX because the count and MBE_REUSABLE_B are updated under the same buffer lock. A corrupted filesystem can violate that invariant. The syzbot reproducer reports allocator and xattr corruption before triggering this retry loop. Check the untrusted on-disk count before incrementing it, avoiding overflow, and clear MBE_REUSABLE_B when it is already saturated. The next lookup then skips the entry that was just proven unusable. This mirrors the normal transition at EXT4_XATTR_REFCOUNT_MAX; the release path marks the entry reusable again on the exact 1024-to-1023 transition. Using the same QEMU harness and guest parameters, current unpatched Linux hung in 6 of 8 420-second trials with the do_rmdir signature; representative NMI backtraces caught the owner spinning in ext4_xattr_block_set(). The patched kernel completed 28 of 28 trials without a hung-task report; the final twelve trials exercised the reviewed overflow-safe form of the change. syzbot's patch testing also completed without reproducing the hang. The Linux kernel CVE team has assigned CVE-2026-80808 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10.163 with commit 1a56cd972ce121b6cf2517a47a578782bbd2ec95 and fixed in 5.10.267 with commit 119a2f053242ed75bdd2ebc95baf3ae7db6ccacf Issue introduced in 5.15.61 with commit 1be97463696c7291a3e1547614e96432b0bd3add and fixed in 5.15.218 with commit 61631352a5b405c89be579de00903b72e6888aa4 Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.1.185 with commit 8865cd664484517703df5c18a965dc3227572b87 Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.6.154 with commit a40c45268f4358207aa9c53764fed2e05f62986a Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.12.106 with commit 889ec86464d261f026f6c334040cfc6c58c99d58 Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 6.18.47 with commit 4902a5cba21aeaf91e6b29e20e0967a5f6abdcd9 Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 7.1.11 with commit 55ee6533c1db7f7656fa8dd19637f3f8b8c08dc5 Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 7.2.1 with commit dbd4aea175ad3c46436acb251e817b4374628072 Issue introduced in 6.0 with commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b and fixed in 7.3-rc1 with commit 54b6bd40898de7906acb2bccc9a96d1b8e6b4323 Issue introduced in 4.19.270 with commit 98953044b3cdb2cb7d82e7365b659e2ed4f4ca4d Issue introduced in 5.4.229 with commit af8ecc8d20e72130771cc076bce7fcf17ccda6c4 Issue introduced in 5.18.18 with commit c6fac5cf5a5098732623bcd00a8a3eb9f5465144 Issue introduced in 5.19.2 with commit 96fa141fa295ae9428da73c56c9852053b575c04 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80808 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ext4/xattr.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/119a2f053242ed75bdd2ebc95baf3ae7db6ccacf https://git.kernel.org/stable/c/61631352a5b405c89be579de00903b72e6888aa4 https://git.kernel.org/stable/c/8865cd664484517703df5c18a965dc3227572b87 https://git.kernel.org/stable/c/a40c45268f4358207aa9c53764fed2e05f62986a https://git.kernel.org/stable/c/889ec86464d261f026f6c334040cfc6c58c99d58 https://git.kernel.org/stable/c/4902a5cba21aeaf91e6b29e20e0967a5f6abdcd9 https://git.kernel.org/stable/c/55ee6533c1db7f7656fa8dd19637f3f8b8c08dc5 https://git.kernel.org/stable/c/dbd4aea175ad3c46436acb251e817b4374628072 https://git.kernel.org/stable/c/54b6bd40898de7906acb2bccc9a96d1b8e6b4323