{"id":"CVE-2026-80805","title":"xfs: validate attr entry pointer before field access","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: validate attr entry pointer before field access\n\nxfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen,\nvaluelen) before checking if the entry point…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 0f82586741e39926542f621bafa424e237a04fa4","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 134d82a2b5e3eba3ebf58753a1387b22f26ca1de","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 03a12253dd2a036545bdb0110a4e0b8dc70f8e7c","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < e99120b5944a16d0bc27e52b33de78bcdaaabf5c","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 98a42bb9d60d42898c3494de351a1bf508348cde","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 184c1a80421a5b5ddcd262e47980ce2e67fee211","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 9f92e749fc08b7ff3d9da190c4d1b2273745b282","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < c35da2bac6f7cb9a9be73f188b4fcc324615c327","Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < b7eea80be25f3334f131d52982b3131aba77b97d","Linux 5.5"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:43:58.417Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80805","references":[{"url":"https://git.kernel.org/stable/c/0f82586741e39926542f621bafa424e237a04fa4"},{"url":"https://git.kernel.org/stable/c/134d82a2b5e3eba3ebf58753a1387b22f26ca1de"},{"url":"https://git.kernel.org/stable/c/03a12253dd2a036545bdb0110a4e0b8dc70f8e7c"},{"url":"https://git.kernel.org/stable/c/e99120b5944a16d0bc27e52b33de78bcdaaabf5c"},{"url":"https://git.kernel.org/stable/c/98a42bb9d60d42898c3494de351a1bf508348cde"},{"url":"https://git.kernel.org/stable/c/184c1a80421a5b5ddcd262e47980ce2e67fee211"},{"url":"https://git.kernel.org/stable/c/9f92e749fc08b7ff3d9da190c4d1b2273745b282"},{"url":"https://git.kernel.org/stable/c/c35da2bac6f7cb9a9be73f188b4fcc324615c327"},{"url":"https://git.kernel.org/stable/c/b7eea80be25f3334f131d52982b3131aba77b97d"}],"tags":["cve.org"],"epss":0.00195,"epssPercentile":0.08589,"ingestedAt":"2026-10-19T10:20:54.959Z","slug":"CVE-2026-80805","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: validate attr entry pointer before field access\n\nxfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen,\nvaluelen) before checking if the entry pointer itself is within bounds.\nIf nameidx is crafted to point near the end of the buffer, these field\naccesses can read out-of-bounds before the bounds check at\nname_end > buf_end is performed.\n\nAdd explicit bounds checks for entry pointers before accessing their\nfields. Use offsetof() to check that the start of the flexible array\nmember (nameval/name) is within bounds, which ensures all preceding\nfields are safe to access.\n\n## Affected\n\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 0f82586741e39926542f621bafa424e237a04fa4`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 134d82a2b5e3eba3ebf58753a1387b22f26ca1de`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 03a12253dd2a036545bdb0110a4e0b8dc70f8e7c`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < e99120b5944a16d0bc27e52b33de78bcdaaabf5c`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 98a42bb9d60d42898c3494de351a1bf508348cde`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 184c1a80421a5b5ddcd262e47980ce2e67fee211`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < 9f92e749fc08b7ff3d9da190c4d1b2273745b282`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < c35da2bac6f7cb9a9be73f188b4fcc324615c327`\n- `Linux >= c84760659dcf237902d4cc997cd5f55cb3b2807f < b7eea80be25f3334f131d52982b3131aba77b97d`\n- `Linux 5.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}