CVE-2026-80533: xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't walk off the end of a null sc->sa.agibp in AGI repair
LOLLM noticed a longstanding bug where xrepiunlinkwalkondiskbucket tries to walk ragi->sc->sa.agibp to rebuild the unlinked inode lists. Unfortunately, it's possible for agibp to be null if the buffer verifier fails, so we have to use ragi->agibp (which skips verifier checks) instead.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with XFS and entering AGI repair are affected when the AGI buffer verifier fails. The vulnerable path is used while rebuilding unlinked inode lists.
What condition causes the invalid access?
The repair code can find sc->sa.agi_bp set to null after a buffer verifier failure, then attempt to walk it. The fix uses ragi->agi_bp instead, which bypasses verifier checks for this repair operation.