CVE-2026-80537

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix off-by-one in rtrefcount btree root level validation

xfs_rtrefcountbt_compute_maxlevels() sets

mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;

where the trailing "+ 1" already accounts for the inode-root level, so the

deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must

satisfy bc_nlevels <= bc_maxlevels (= m_rtrefc_maxlevels).

The two on-disk validation paths, xfs_rtrefcountbt_verify() and

xfs_iformat_rtrefcount(), check the root level with ">" instead of ">=", so a

crafted rtreflink (metadir + realtime + reflink) image whose

/rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on

mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1,

exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is

sized for exactly bc_maxlevels entries, the first btree op on such a cursor

indexes bc_levels[m_rtrefc_maxlevels] past

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References