{"id":"CVE-2026-80808","summary":"ext4: stop retrying saturated xattr cache entries","details":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: stop retrying saturated xattr cache entries\n\next4_xattr_block_set() retries when a cache entry selected for reuse\nhas a saturated reference count after taking the buffer lock. The retry\nreturns to the mbcache lookup without making that entry ineligible, so\nit can select the same unusable entry indefinitely. A task spinning\nthere can hold the parent directory's i_rwsem and leave concurrent\nrmdir callers blocked.\n\nNormally a reusable entry has a reference count below\nEXT4_XATTR_REFCOUNT_MAX because the count and MBE_REUSABLE_B are\nupdated under the same buffer lock. A corrupted filesystem can violate\nthat invariant. The syzbot reproducer reports allocator and xattr\ncorruption before triggering this retry loop.\n\nCheck the untrusted on-disk count before incrementing it, avoiding\noverflow, and clear MBE_REUSABLE_B when it is already saturated. The\nnext lookup then skips the entry that was just proven unusable. This\nmirrors the normal transition at EXT4_XATTR_REFCOUNT_MAX; the release\npath marks the entry reusable again on the exact 1024-to-1023\ntransition.\n\nUsing the same QEMU harness and guest parameters, current unpatched\nLinux hung in 6 of 8 420-second trials with the do_rmdir signature;\nrepresentative NMI backtraces caught the owner spinning in\next4_xattr_block_set(). The patched kernel completed 28 of 28 trials\nwithout a hung-task report; the final twelve trials exercised the\nreviewed overflow-safe form of the change. syzbot's patch testing also\ncompleted without reproducing the hang.","modified":"2026-11-06T12:41:58.499916298Z","published":"2026-09-04T15:13:28.562Z","related":["SUSE-SU-2026:5091-1","SUSE-SU-2026:5121-1","openSUSE-SU-2026:11773-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80808.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/119a2f053242ed75bdd2ebc95baf3ae7db6ccacf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4902a5cba21aeaf91e6b29e20e0967a5f6abdcd9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/54b6bd40898de7906acb2bccc9a96d1b8e6b4323"},{"type":"WEB","url":"https://git.kernel.org/stable/c/55ee6533c1db7f7656fa8dd19637f3f8b8c08dc5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/61631352a5b405c89be579de00903b72e6888aa4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8865cd664484517703df5c18a965dc3227572b87"},{"type":"WEB","url":"https://git.kernel.org/stable/c/889ec86464d261f026f6c334040cfc6c58c99d58"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a40c45268f4358207aa9c53764fed2e05f62986a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dbd4aea175ad3c46436acb251e817b4374628072"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80808.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80808"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1a56cd972ce121b6cf2517a47a578782bbd2ec95"},{"fixed":"119a2f053242ed75bdd2ebc95baf3ae7db6ccacf"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1be97463696c7291a3e1547614e96432b0bd3add"},{"fixed":"61631352a5b405c89be579de00903b72e6888aa4"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"65f8b80053a1b2fd602daa6814e62d6fa90e5e9b"},{"fixed":"8865cd664484517703df5c18a965dc3227572b87"},{"fixed":"a40c45268f4358207aa9c53764fed2e05f62986a"},{"fixed":"889ec86464d261f026f6c334040cfc6c58c99d58"},{"fixed":"4902a5cba21aeaf91e6b29e20e0967a5f6abdcd9"},{"fixed":"55ee6533c1db7f7656fa8dd19637f3f8b8c08dc5"},{"fixed":"dbd4aea175ad3c46436acb251e817b4374628072"},{"fixed":"54b6bd40898de7906acb2bccc9a96d1b8e6b4323"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.163"},{"fixed":"5.10.267"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.15.61"},{"fixed":"5.15.218"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.19.270"},{"fixed":"4.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.4.229"},{"fixed":"5.5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.18.18"},{"fixed":"5.19"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.19.2"},{"fixed":"5.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"98953044b3cdb2cb7d82e7365b659e2ed4f4ca4d"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"af8ecc8d20e72130771cc076bce7fcf17ccda6c4"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c6fac5cf5a5098732623bcd00a8a3eb9f5465144"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"96fa141fa295ae9428da73c56c9852053b575c04"}]}],"versions":["v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220","v5.10.219","v5.10.218","v5.10.217","v5.10.216","v5.10.215","v5.10.214","v5.10.213","v5.10.212","v5.10.211","v5.10.210","v5.10.209","v5.10.208","v5.10.207","v5.10.206","v5.10.205","v5.10.204","v5.10.203","v5.10.202","v5.10.201","v5.10.200","v5.10.199","v5.10.198","v5.10.197","v5.10.196","v5.10.195","v5.10.194","v5.10.193","v5.10.192","v5.10.191","v5.10.190","v5.10.189","v5.10.188","v5.10.187","v5.10.186","v5.10.185","v5.10.184","v5.10.183","v5.10.182","v5.10.181","v5.10.180","v5.10.179","v5.10.178","v5.10.177","v5.10.176","v5.10.175","v5.10.174","v5.10.173","v5.10.172","v5.10.171","v5.10.170","v5.10.169","v5.10.168","v5.10.167","v5.10.166","v5.10.165","v5.10.164","v5.10.163","v5.15.217","v5.15.216","v5.15.215","v5.15.214","v5.15.213","v5.15.212","v5.15.211","v5.15.210","v5.15.209","v5.15.208","v5.15.207","v5.15.206","v5.15.205","v5.15.204","v5.15.203","v5.15.202","v5.15.201","v5.15.200","v5.15.199","v5.15.198","v5.15.197","v5.15.196","v5.15.195","v5.15.194","v5.15.193","v5.15.192","v5.15.191","v5.15.190","v5.15.189","v5.15.188","v5.15.187","v5.15.186","v5.15.185","v5.15.184","v5.15.183","v5.15.182","v5.15.181","v5.15.180","v5.15.179","v5.15.178","v5.15.177","v5.15.176","v5.15.175","v5.15.174","v5.15.173","v5.15.172","v5.15.171","v5.15.170","v5.15.169","v5.15.168","v5.15.167","v5.15.166","v5.15.165","v5.15.164","v5.15.163","v5.15.162","v5.15.161","v5.15.160","v5.15.159","v5.15.158","v5.15.157","v5.15.156","v5.15.155","v5.15.154","v5.15.153","v5.15.152","v5.15.151","v5.15.150","v5.15.149","v5.15.148","v5.15.147","v5.15.146","v5.15.145","v5.15.144","v5.15.143","v5.15.142","v5.15.141","v5.15.140","v5.15.139","v5.15.138","v5.15.137","v5.15.136","v5.15.135","v5.15.134","v5.15.133","v5.15.132","v5.15.131","v5.15.130","v5.15.129","v5.15.128","v5.15.127","v5.15.126","v5.15.125","v5.15.124","v5.15.123","v5.15.122","v5.15.121","v5.15.120","v5.15.119","v5.15.118","v5.15.117","v5.15.116","v5.15.115","v5.15.114","v5.15.113","v5.15.112","v5.15.111","v5.15.110","v5.15.109","v5.15.108","v5.15.107","v5.15.106","v5.15.105","v5.15.104","v5.15.103","v5.15.102","v5.15.101","v5.15.100","v5.15.99","v5.15.98","v5.15.97","v5.15.96","v5.15.95","v5.15.94","v5.15.93","v5.15.92","v5.15.91","v5.15.90","v5.15.89","v5.15.88","v5.15.87","v5.15.86","v5.15.85","v5.15.84","v5.15.83","v5.15.82","v5.15.81","v5.15.80","v5.15.79","v5.15.78","v5.15.77","v5.15.76","v5.15.75","v5.15.74","v5.15.73","v5.15.72","v5.15.71","v5.15.70","v5.15.69","v5.15.68","v5.15.67","v5.15.66","v5.15.65","v5.15.64","v5.15.63","v5.15.62","v5.15.61","v4.19.325","v4.19.324","v4.19.323","v4.19.322","v4.19.321","v4.19.320","v4.19.319","v4.19.318","v4.19.317","v4.19.316","v4.19.315","v4.19.314","v4.19.313","v4.19.312","v4.19.311","v4.19.310","v4.19.309","v4.19.308","v4.19.307","v4.19.306","v4.19.305","v4.19.304","v4.19.303","v4.19.302","v4.19.301","v4.19.300","v4.19.299","v4.19.298","v4.19.297","v4.19.296","v4.19.295","v4.19.294","v4.19.293","v4.19.292","v4.19.291","v4.19.290","v4.19.289","v4.19.288","v4.19.287","v4.19.286","v4.19.285","v4.19.284","v4.19.283","v4.19.282","v4.19.281","v4.19.280","v4.19.279","v4.19.278","v4.19.277","v4.19.276","v4.19.275","v4.19.274","v4.19.273","v4.19.272","v4.19.271","v4.19.270","v5.4.302","v5.4.301","v5.4.300","v5.4.299","v5.4.298","v5.4.297","v5.4.296","v5.4.295","v5.4.294","v5.4.293","v5.4.292","v5.4.291","v5.4.290","v5.4.289","v5.4.288","v5.4.287","v5.4.286","v5.4.285","v5.4.284","v5.4.283","v5.4.282","v5.4.281","v5.4.280","v5.4.279","v5.4.278","v5.4.277","v5.4.276","v5.4.275","v5.4.274","v5.4.273","v5.4.272","v5.4.271","v5.4.270","v5.4.269","v5.4.268","v5.4.267","v5.4.266","v5.4.265","v5.4.264","v5.4.263","v5.4.262","v5.4.261","v5.4.260","v5.4.259","v5.4.258","v5.4.257","v5.4.256","v5.4.255","v5.4.254","v5.4.253","v5.4.252","v5.4.251","v5.4.250","v5.4.249","v5.4.248","v5.4.247","v5.4.246","v5.4.245","v5.4.244","v5.4.243","v5.4.242","v5.4.241","v5.4.240","v5.4.239","v5.4.238","v5.4.237","v5.4.236","v5.4.235","v5.4.234","v5.4.233","v5.4.232","v5.4.231","v5.4.230","v5.4.229","v5.18.19","v5.18.18","v5.19.17","v5.19.16","v5.19.15","v5.19.14","v5.19.13","v5.19.12","v5.19.11","v5.19.10","v5.19.9","v5.19.8","v5.19.7","v5.19.6","v5.19.5","v5.19.4","v5.19.3","v5.19.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80808.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.267"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.218"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.185"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.6.154"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.12.106"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.18.47"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"7.1.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80808.json"}}],"schema_version":"1.9.2"}