CVE-2026-80808: ext4: stop retrying saturated xattr cache entries

In the Linux kernel, the following vulnerability has been resolved:

ext4: stop retrying saturated xattr cache entries

ext4xattrblockset() retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without making that entry ineligible, so it can select the same unusable entry indefinitely. A task spinning there can hold the parent directory's irwsem and leave concurrent rmdir callers blocked.

Normally a reusable entry has a reference count below EXT4XATTRREFCOUNTMAX because the count and MBEREUSABLEB are updated under the same buffer lock. A corrupted filesystem can violate that invariant. The syzbot reproducer reports allocator and xattr corruption before triggering this retry loop.

Check the untrusted on-disk count before incrementing it, avoiding overflow, and clear MBEREUSABLEB when it is already saturated. The next lookup then skips the entry that was just proven unusable. This mirrors the normal transition at EXT4XATTRREFCOUNTMAX; the release path marks the entry reusable again on the exact 1024-to-1023 transition.

Using the same QEMU harness and guest parameters, current unpatched Linux hung in 6 of 8 420-second trials with the dormdir signature; representative NMI backtraces caught the owner spinning in ext4xattrblockset(). The patched kernel completed 28 of 28 trials without a hung-task report; the final twelve trials exercised the reviewed overflow-safe form of the change. syzbot's patch testing also completed without reproducing the hang.