UBUNTU-CVE-2026-80533: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a null sc->sa.agibp in AGI repair LOLLM noticed a longstanding bug where xrepiunlinkwalkondiskbucket tries to walk ragi->sc->sa.agibp to rebuild the unlinked inode lists. Unfortunately, it's possible for agibp to be null if the buffer verifier fails, so we have to use ragi->agibp (which skips verifier checks) instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0. No affected or fixed version information is provided.
What condition is involved in triggering the faulty code path?
The issue occurs during XFS AGI repair while rebuilding unlinked inode lists from on-disk buckets. The relevant pointer can be null when the buffer verifier fails, after which the repair code can walk past the end of that null state.
What does the fix change?
The repair code uses ragi->agi_bp instead of ragi->sc->sa.agi_bp when walking the on-disk bucket data. The replacement buffer reference skips verifier checks and is intended to remain available for this repair path.