CVE-2026-80899 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel deployments using EROFS should assess exposure and prioritize verification of EROFS usage. They should also review Nydus usage and plan for migration to fanotify pre-content hooks. This requires coordination with Linux kernel maintainers and Nydus developers to ensure a smooth transition.

Why it matters

The Linux kernel removed the EROFS over fscache feature due to deprecation and implementation issues, requiring defenders to assess exposure and prioritize verification of EROFS usage.

• Verify EROFS usage and potential exposure in Linux kernel deployments
• Assess the need for migration to EROFS file-backed mounts and fanotify pre-content hooks
• Review Nydus usage and plan for migration to fanotify pre-content hooks

Technical summary

The Linux kernel removed the EROFS over fscache feature due to its deprecation and newly found implementation issues. The feature was replaced by EROFS file-backed mounts and fanotify pre-content hooks. This change affects Linux kernel deployments using EROFS. Defenders should assess exposure and prioritize verification of EROFS usage. The main application of this feature, Nydus, plans to move to using fanotify pre-content hooks. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later.

Defensive priority

Defenders should assess exposure and prioritize verification of EROFS usage in their Linux kernel deployments.

Recommended defensive actions

• Assess EROFS usage in Linux kernel deployments
• Verify EROFS file-backed mounts and fanotify pre-content hooks are in use
• Review Nydus usage and plan for migration to fanotify pre-content hooks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source references provide information on the removal of the EROFS over fscache feature from the Linux kernel. This feature was introduced for image lazy pulling functionality but has been replaced by EROFS file-backed mounts and fanotify pre-content hooks. The main application of this feature, Nydus, plans to move to using fanotify pre-content hooks. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later. The codebase is isolated by CONFIG_CACHEFILES_ONDEMAND. Defs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.