HIGH Introduced in 6.13
xfs RtGroupInode Error
CVE-2026-80538
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
KernelScan AI5.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfs_rtginode_load xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs then continues as though the inode had been loaded. Only -ENOENT means that the inode needs to be created. Return all other errors to the growfs caller.
02KernelScan AI Analysis
Risk summary
A logic error in XFS realtime group inode handling causes growfs to continue with an unset inode after I/O, allocation, or corruption errors. This can lead to filesystem corruption or kernel panic when the filesystem is grown. The bug requires root privileges (CAP_SYS_ADMIN) to trigger via the growfs operation.
Vulnerability analysis
During XFS growfs operations, the code that ensures realtime group inodes are loaded treats unexpected errors as success. When an I/O, allocation, or corruption error occurs while loading a realtime group inode, the error is silently ignored and growfs proceeds as if the inode had been successfully loaded, leaving it unset. This can result in subsequent operations accessing an uninitialized or missing inode, potentially causing filesystem corruption or a kernel panic. The fix propagates these errors back to the growfs caller so the operation aborts cleanly. The vulnerable code path is reachable only by a privileged user with CAP_SYS_ADMIN who can initiate a growfs operation on an XFS filesystem with realtime volumes enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.13 | 6.18.46 | ec19cea4ef1c |
| 7.1 | 6.13 | 7.1.10 | 61c5165f02de |
| mainline | 6.13 | 7.2 | b7e53968cb88 |