CVE-2026-80808

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: stop retrying saturated xattr cache entries

ext4_xattr_block_set() retries when a cache entry selected for reuse

has a saturated reference count after taking the buffer lock. The retry

returns to the mbcache lookup without making that entry ineligible, so

it can select the same unusable entry indefinitely. A task spinning

there can hold the parent directory's i_rwsem and leave concurrent

rmdir callers blocked.

Normally a reusable entry has a reference count below

EXT4_XATTR_REFCOUNT_MAX because the count and MBE_REUSABLE_B are

updated under the same buffer lock. A corrupted filesystem can violate

that invariant. The syzbot reproducer reports allocator and xattr

corruption before triggering this retry loop.

Check the untrusted on-disk count before incrementing it, avoiding

overflow, and clear MBE_REUSABLE_B when it is already saturated. The

next lookup then skips the entry that was just proven unusable. This

m

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References