CVE-2026-80536

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfs: bounds-check buffer log item's dirty bitmap

xlog_recover_do_reg_buffer() replays each dirty region described by a

buffer log item's bitmap into the buffer read for that item:

memcpy(xfs_buf_offset(bp, (uint)bit << XFS_BLF_SHIFT),

item->ri_buf[i].iov_base,

nbits << XFS_BLF_SHIFT);

The destination offset (bit/nbits, from the logged dirty bitmap) and the

buffer size (from the logged blf_len) are both attacker-controlled and

otherwise unrelated, yet the only thing bounding the copy is an ASSERT(),

which compiles away on production kernels. A crafted image logging a

small blf_len together with a bitmap bit past the end of that buffer

drives the memcpy() past the buffer's allocation, corrupting adjacent

kernel heap during mount-time log recovery. This is reachable by anyone

who can get a crafted image mounted -- the malicious-filesystem threat

model XFS already guards against elsewhere.

Turn the ASSERT() into

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References