Executive brief
The Linux kernel XFS filesystem has a data corruption vulnerability in its file range exchange feature. When exchanging file data that share common blocks (reflink), the system may incorrectly clear copy-on-write protections, leading to unprotected writes that corrupt shared data between reflink-related files. This affects any Linux system using XFS with reflink functionality.
Technical details
The vulnerability is a logic error in XFS's xmi_can_exchange_reflink_flags() function. When the XFS_EXCHMAPS_INO1_WRITTEN optimization flag is set during file range exchange, the code assumes all shared extents will be moved between files and proceeds to swap reflink flags. However, the optimization can skip unmapped and unwritten regions, leaving some shared extents in their original location. This causes the post-operation cleanup to incorrectly clear the reflink flag from an inode that still owns shared written extents, breaking the copy-on-write protection mechanism. Subsequent writes then take the non-reflink path and corrupt blocks that should have been protected by CoW. The fix disables reflink flag exchange when XFS_EXCHMAPS_INO1_WRITTEN is requested, allowing both inodes to retain the reflink flag until regular cleanup removes it once shared extents are truly gone. The vulnerability affects Linux kernel v6.10 and later, and is patched in stable branches.
Affected products
- Linux Linux kernel v6.10 and later
Timeline
- 2026-08-26: disclosed: CVE-2026-80530 published
- 2026-08-23: patched: Patch applied to stable branches via commit 03c9c9116e6da641424681f705698d7f5e2128e0 and 0f27b22343b63e10773e6781344640c2c753eec3