Executive brief
F2FS is a flash-friendly file system used in Linux kernels, particularly on mobile and embedded devices. A vulnerability in the extended attribute (xattr) listing function could allow local attackers with file system access to trigger a use-after-free or information disclosure by crafting corrupted xattr entries, potentially leading to kernel crashes or data leakage.
Technical details
The vulnerability exists in the f2fs_listxattr() function in fs/f2fs/xattr.c, where xattr entry validation was performed after attempting to read the entry's fields, rather than before. An attacker can craft a corrupted xattr entry positioned outside the valid xattr storage area to trigger an out-of-bounds read. The fix moves validation before field access and returns -EFSCORRUPTED to properly handle the error instead of returning partial success. Attack requires local access to the file system. The vulnerability affects all Linux kernel versions with the vulnerable f2fs implementation.
Affected products
- Linux Linux kernel all versions before fix (F2FS subsystem)
Timeline
- 2026-08-28: disclosed: CVE-2026-80591 published
- 2026-07-03: patched: Upstream fix committed (5ef5bc304f23c3fe255d4936472378dcb74d0e94)