Junglewise Threat Intelligence

CVE-2026-80820: Linux kernel XFS denial of service in unlinked list scrub

CVE-2026-80820 · Severity: info · Published 2026-09-04

Executive brief

The Linux kernel's XFS filesystem includes an online file system checker (fsck) that can become stuck in an infinite loop if the unlinked inode list contains a circular reference. This can cause the system to become unresponsive when filesystem maintenance is performed. The fix adds cycle detection to prevent the livelock.

Technical details

The vulnerability is a denial-of-service livelock in the XFS online filesystem scrub functionality. The root cause is insufficient cycle detection in the unlinked inode list traversal code (fs/xfs/scrub/agheader.c). When walking the unlinked inode list during AGI (allocation group inode) scrub, if a circular reference exists in the list, the code would enter an infinite loop. The fix uses a bitmap-based cycle detector (xagino_bitmap) to track seen inode numbers and detect loops before they cause a livelock. The vulnerability affects the online fsck path which is network-reachable on systems where online scrubbing is enabled, but requires access to trigger filesystem checks. The patch has been applied to stable kernel versions v4.15 and later.

Affected products

  • Linux Linux kernel v4.15 and later (prior to patch)

Timeline

  • 2026-09-04: disclosed
  • 2026-08-27: patched: Stable kernel patch committed

References

Related threats