# CVE-2026-80537: linux: In the Linux kernel, the following vulnerability has been resolved:  xfs: fix off-by-one in rtrefcount btree root lev...

CVE-2026-80537 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80537 (version 7.1.10-1), released September 4, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-80537
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0013
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 26, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  xfs: fix off-by-one in rtrefcount btree root level validation  xfs_rtrefcountbt_compute_maxlevels() sets  	mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;  where the trailing "+ 1" already accounts for the inode-root level, so the deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must satisfy bc_nlevels <= bc_maxlevels (= m_rtrefc_maxlevels).  The two on-disk validation paths, xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount(), check the root level with ">" instead of ">=", so a crafted rtreflink (metadir + realtime + reflink) image whose /rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1, exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, the first btree op on such a cursor indexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is reached by the first rtrefcount cursor built after mount, via log/CoW recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an FS_IOC_GETFSMAP over the realtime device.  Reject a root level equal to m_rtrefc_maxlevels, matching the ">=" form already used by the sibling data-device refcount/rmap verifiers and the in-memory rtrmap verifier.    BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)   Write of size 2 at addr ffff888018391658 by task exploit/144    xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)    xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308)    xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113)    xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085)    xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551)    xfs_mountfs (fs/xfs/xfs_mount.c:1158)    xfs_fs_fill_super (fs/xfs/xfs_super.c:1940)    get_tree_bdev_flags (fs/super.c:1634)    vfs_get_tree (fs/super.c:1694)    path_mount (fs/namespace.c:4161)    __x64_sys_mount (fs/namespace.c:4367)    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)   The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216   The buggy address is located 8 bytes to the right of    allocated 216-byte region [ffff888018391578, ffff888018391650)   Kernel panic - not syncing: Fatal exception

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.10-1 | [DEBIAN-CVE-2026-80537](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80537.md) | Sep 4, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.