{ "cveId": "CVE-2026-80734", "url": "https://patchblox.com/security/cve/CVE-2026-80734", "summary": "CVE-2026-80734 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-80734, released September 4, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached...", "description": "In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes [BUG] When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERT()s related to folio size: 795 (241074): drop_caches: 3 assertion failed: IS_ALIGNED(start, blocksize) \u0026\u0026 IS_ALIGNED(end \u002B 1, blocksize), in extent_io.c:1404 (blocksize=8192 root=262 ino=258 start=16826368 end=16830463 mapping min order=0) ------------[ cut here ]------------ kernel BUG at extent_io.c:1404! Oops: invalid opcode: 0000 [#1] SMP CPU: 8 UID: 0 PID: 241105 Comm: fsstress Tainted: G OE 7.2.0-rc5-custom\u002B #442 PREEMPT(full) f4bfb352566f3949f29c233ce6f735050a03b245 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 \u002B ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:assert_folio_range.cold\u002B0x3d/0x3f [btrfs] Call Trace: \u003CTASK\u003E btrfs_read_folio\u002B0x9e/0x170 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3] prepare_one_folio.constprop.0\u002B0x104/0x2a0 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3] btrfs_buffered_write\u002B0x285/0xa50 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3] btrfs_do_write_iter\u002B0x1aa/0x210 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3] iter_file_splice_write\u002B0x31a/0x540 direct_splice_actor\u002B0x53/0x170 splice_direct_to_actor\u002B0xe9/0x240 do_splice_direct\u002B0x76/0xb0 vfs_copy_file_range\u002B0x1fd/0x630 __x64_sys_copy_file_range\u002B0xf9/0x220 do_syscall_64\u002B0xe1/0x790 entry_SYSCALL_64_after_hwframe\u002B0x4b/0x53 \u003C/TASK\u003E ---[ end trace 0000000000000000 ]--- The ASSERT() itself is added by a later patch. The crash is triggered with that new debug patch, and without this fix. [CAUSE] In the above case, the start 16826368 is properly 8K aligned, but the end (16830463 \u002B 1) is not 8K aligned. Furthermore the mapping\u0027s minimal folio order is 0, not the expected 1 for 8K block size with 4K page size. So this means some inodes do not have btrfs_set_inode_mapping_order() called on it. The missing btrfs_set_inode_mapping_order() call happens for cached inodes, through the following events: - btrfs_create_new_inode() called for inode X Which properly sets minimal folio order for the VFS inode. - btrfs_update_inode() called for inode X Which calls btrfs_delayed_update_inode() to create a delayed_node into root-\u003Edelayed_nodes xarray. - Drop cache/memory pressure, evicting in-memory inode X Which evicted the inode X, but delayed_node is still in root-\u003Edelayed_nodes for future reuse. - btrfs_iget() for inode X called again btrfs_iget() |- btrfs_iget_locked() | |- iget5_locked_rcu() | Which creates a new vfs_inode for btrfs, whose mapping still | has the minimal order as 0. | |- btrfs_read_locked_inode() |- btrfs_fill_inode() | |- btrfs_get_delayed_node() | Which found out the previous node, and use that delayed | node to initialize the new inode. | |- filled = true; |- if (filled) goto cache_index; Which skips the btrfs_update_inode_mapping_flags() and \tbtrfs_set_inode_mapping_order() calls. \tSo the inode still has minimal folio order set as 0, not \tthe required 1. Thus later page cache read will get a folio whose size is smaller than block size, as the mapping has its minimal folio order set as 0 not 1, then trigger the ASSERT(). [FIX] Move the btrfs_update_inode_mapping_flags() and btrfs_set_inode_mapping_order() calls under cache_index label, so that the mapping flags and minimal folio order is always set no matter if we have a cached inode.", "published": "2026-09-03T13:06:12Z", "severity": "high", "cvss": 8.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.00415, "epssPercentile": 0.3605, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.56-125.164", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.115-2", "fix": "DEBIAN-CVE-2026-80734", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80734", "released": "2026-09-04T01:46:23Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.1.9-1", "fix": "DEBIAN-CVE-2026-80734", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80734", "released": "2026-09-04T01:46:23Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }