Junglewise Threat Intelligence

CVE-2026-80535: Linux kernel XFS double-lock in directory tree repair

CVE-2026-80535 · Severity: info · Published 2026-08-26

Executive brief

The Linux kernel's XFS filesystem contains a locking bug in the directory tree repair code. When a directory refers to itself (a rare edge case), the repair function attempts to acquire the same lock twice on the same inode, which can cause a system hang or deadlock. This affects systems using XFS filesystems that trigger the directory tree scrubber repair logic.

Technical details

The vulnerability is a double-lock issue (resource deadlock) in the XFS directory tree repair code (fs/xfs/scrub/dirtree_repair.c). When the dirtree scrubber detects a self-referential directory (where sc->ip equals dp), the repair code attempts to acquire XFS_IOLOCK_EXCL and XFS_ILOCK_EXCL locks on both sc->ip and dp without first checking if they are the same inode. Since both variables reference the same inode object, attempting to lock it twice causes a deadlock. The fix adds conditional checks to skip the second lock acquisition and uses the appropriate single-inode transaction allocation path when sc->ip == dp. The vulnerability was introduced in kernel v6.10 and requires the dirtree scrubber to detect the self-referential condition to be triggered.

Affected products

  • Linux Linux kernel v6.10 and later

Timeline

  • 2026-08-26: disclosed
  • 2026-07-26: patched

References

Related threats