Improper control of a resource through its lifetime in Linux kernel - CVE-2026-80530
Published: August 27, 2026
Vulnerability identifier: #VU145961
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80530
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to corrupt data.
The vulnerability exists due to improper state management in xmi_can_exchange_reflink_flags in the XFS exchange-range handling when exchanging full-file ranges with XFS_EXCHMAPS_INO1_WRITTEN set. A local user can trigger a crafted exchange operation to corrupt data.
The issue occurs because hole and unwritten mappings from the first file can be skipped, leaving shared written extents on an inode whose reflink flag is later cleared.
Affected software
Linux kernel
How to mitigate CVE-2026-80530
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3