CVE-2026-80805: xfs: validate attr entry pointer before field access
In the Linux kernel, the following vulnerability has been resolved:
xfs: validate attr entry pointer before field access
xfsattr3leafverifyentry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at nameend > bufend is performed.
Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the resolved fix described: use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds before performing checks like name_end > buf_end; validate that the entry pointer itself is within bounds prior to accessing entry fields (e.g., namelen/valuelen) and before field reads from lentry/rentry.
Linux kernel (XFS) xfs_attr3_leaf_verify_entry(): add bounds checks for attr entry pointer before field access = Explicitly validate that the entry pointer and flexible-array start (nameval/name) are within bounds before accessing fields
Event History
Frequently Asked Questions
What input condition is needed to trigger the out-of-bounds read?
The attribute entry's nameidx must be crafted to point near the end of the buffer. This causes the verifier to access entry fields such as namelen and valuelen before confirming that the entry pointer is in bounds.
What does the fix change?
The fix adds explicit bounds checks for attribute entry pointers before any of their fields are accessed. It checks that the start of the flexible name/value array is within the buffer, ensuring preceding fields are safe to read.