CVE-2026-80530 Linux CVE debrief

Who should care

Linux kernel developers, XFS filesystem administrators, and users of Linux-based systems should be aware of this vulnerability and take necessary actions to prevent potential data corruption. They should review the XFS filesystem configurations, check for potential data corruption, and monitor for suspicious activity. Additionally, they should apply the patch to fix the exchange-range reflink flag clearing issue and update XFS filesystem configurations to prevent similar issues.

Technical summary

The vulnerability is caused by the incorrect clearing of the reflink flag from an inode that still owns shared written extents, leading to potential data corruption. The issue arises when exchanging two full-file ranges and the XFS_EXCHMAPS_INO1_WRITTEN flag is set. This occurs because xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings from file1, allowing an exchange to complete without moving every mapping that the earlier flag-swap decision accounted for. As a result, post-operation cleanup can clear the reflink flag from an inode that still owns shared written extents. Later writes then take the non-reflink write path and may update blocks that should still have been protected by CoW, showing up as data corruption between reflink-related files. The fix involves disabling the reflink flag exchange whenever XFS_EXCHMAPS_INO1_WRITTEN is requested.

Defensive priority

High priority due to potential data corruption

Recommended defensive actions

• Apply the patch to fix the exchange-range reflink flag clearing issue
• Review and update XFS filesystem configurations to prevent similar issues
• Monitor for potential data corruption and perform regular filesystem checks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the incorrect clearing of the reflink flag from an inode that still owns shared written extents, leading to potential data corruption. This issue arises when exchanging two full-file ranges and the XFS_EXCHMAPS_INO1_WRITTEN flag is set. The problem occurs because xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings from file1, allowing an exchange to complete without moving every mapping that the earlier flag-swap decision accounted for. As a result, post-operation cleanup can clear the reflink flag from an inode that still owns shared written extents. Later writes then take the non-reflink write path and may update blocks that should still have been protected by CoW, showing up as data corruption between reflink-related files. To verify, defenders should review the XFS filesystem configurations, check for potential data corruption, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.