{
  "cveId": "CVE-2026-80537",
  "url": "https://patchblox.com/security/cve/CVE-2026-80537",
  "summary": "CVE-2026-80537 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80537 (version 7.1.10-1), released September 4, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  xfs: fix off-by-one in rtrefcount btree root lev...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  xfs: fix off-by-one in rtrefcount btree root level validation  xfs_rtrefcountbt_compute_maxlevels() sets  \tmp-\u003Em_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) \u002B 1;  where the trailing \u0022\u002B 1\u0022 already accounts for the inode-root level, so the deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must satisfy bc_nlevels \u003C= bc_maxlevels (= m_rtrefc_maxlevels).  The two on-disk validation paths, xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount(), check the root level with \u0022\u003E\u0022 instead of \u0022\u003E=\u0022, so a crafted rtreflink (metadir \u002B realtime \u002B reflink) image whose /rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level \u002B 1, exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, the first btree op on such a cursor indexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is reached by the first rtrefcount cursor built after mount, via log/CoW recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an FS_IOC_GETFSMAP over the realtime device.  Reject a root level equal to m_rtrefc_maxlevels, matching the \u0022\u003E=\u0022 form already used by the sibling data-device refcount/rmap verifiers and the in-memory rtrmap verifier.    BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)   Write of size 2 at addr ffff888018391658 by task exploit/144    xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)    xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308)    xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113)    xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085)    xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551)    xfs_mountfs (fs/xfs/xfs_mount.c:1158)    xfs_fs_fill_super (fs/xfs/xfs_super.c:1940)    get_tree_bdev_flags (fs/super.c:1634)    vfs_get_tree (fs/super.c:1694)    path_mount (fs/namespace.c:4161)    __x64_sys_mount (fs/namespace.c:4367)    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)   The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216   The buggy address is located 8 bytes to the right of    allocated 216-byte region [ffff888018391578, ffff888018391650)   Kernel panic - not syncing: Fatal exception",
  "published": "2026-08-26T15:17:07Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00127,
  "epssPercentile": 0.02408,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.10-1",
      "fix": "DEBIAN-CVE-2026-80537",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80537",
      "released": "2026-09-04T01:46:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}