CVE-2026-80537

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An off-by-one error exists in the root level validation of the rtrefcount btree within the XFS file system. The functions xfs rtrefcountbt verify() and xfs iformat rtrefcount() incorrectly use a greater-than operator instead of greater-than-or-equal-to when checking the root level. This allows a specially crafted rtreflink image to be accepted during mount if the /rtgroups/N.refcount inode has a bb level equal to m rtrefc maxlevels. Subsequently, xfs rtrefcountbt init cursor() sets bc nlevels to a value that exceeds bc maxlevels by one. Because the xfs rtrefcountbt cur slab object is sized exactly for bc maxlevels entries, the first btree operation on such a cursor results in a slab-out-of-bounds write when indexing bc levels[m rtrefc maxlevels] past the end of the object. This condition can be triggered during log/CoW recovery via xfs reflink recover cow() during mount or through an FS IOC GETFSMAP operation over the realtime device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.