CVE-2026-80532: xfs: fix another iunlink infinite loop bug in online fsck
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix another iunlink infinite loop bug in online fsck
xrepiunlinkresolvebucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it finds on disk and in memory before we move on to relinking the truly lost inodes back into the unlinked list. However, it's still vulnerable to infinite loops that come in via the nextunlinked pointers.
Fix this problem by remembering which inodes we've already seen and checking new agino pointers against that. If a bit is already set, either this is a loop or the inode has nonzero link count. We'll deal with the second case in a subsequent patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What filesystem state is required to trigger the problem?
The issue is triggered when online fsck processes corrupted or cyclic next_unlinked pointers in an XFS unlinked-inode list. Those pointers can cause xrep_iunlink_resolve_bucket to loop indefinitely.
Which systems are exposed?
Systems using the Linux kernel with XFS and its online fsck repair path are relevant. The provided information does not identify affected kernel versions or whether the vulnerable path is enabled by default.
What is the practical impact of exploitation?
The described impact is an infinite loop during online fsck processing of the affected unlinked-list pointers. The data does not describe privilege requirements, remote reachability, or impacts beyond the loop.
How does the fix prevent the loop?
The fix records inodes already encountered while reconstructing unlinked-list pointers and checks new allocation-group inode pointers against that record. Reencountering an inode identifies a loop or an inode with a nonzero link count, preventing repeated traversal.