CVE-2026-80537

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix off-by-one in rtrefcount btree root level validation

xfsrtrefcountbtcompute_maxlevels() sets

mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;

where the trailing "+ 1" already accounts for the inode-root level, so the deepest valid on-disk root level is mrtrefcmaxlevels - 1 and a cursor must satisfy bcnlevels <= bcmaxlevels (= mrtrefcmaxlevels).

The two on-disk validation paths, xfsrtrefcountbtverify() and xfsiformatrtrefcount(), check the root level with ">" instead of ">=", so a crafted rtreflink (metadir + realtime + reflink) image whose /rtgroups/N.refcount inode has bblevel == mrtrefcmaxlevels is accepted on mount. xfsrtrefcountbtinitcursor() then sets bcnlevels = bblevel + 1, exceeding bcmaxlevels by one. Since the xfsrtrefcountbtcur slab object is sized for exactly bcmaxlevels entries, the first btree op on such a cursor indexes bclevels[mrtrefcmaxlevels] past the end of the object. This is reached by the first rtrefcount cursor built after mount, via log/CoW recovery (xfsreflinkrecovercow() during xfsmountfs()) or an FSIOC_GETFSMAP over the realtime device.

Reject a root level equal to mrtrefcmaxlevels, matching the ">=" form already used by the sibling data-device refcount/rmap verifiers and the in-memory rtrmap verifier.

BUG: KASAN: slab-out-of-bounds in xfsbtreelookup (fs/xfs/libxfs/xfsbtree.c:2101) Write of size 2 at addr ffff888018391658 by task exploit/144 xfsbtreelookup (fs/xfs/libxfs/xfsbtree.c:2101) xfsbtreequeryrange (fs/xfs/libxfs/xfsbtree.c:5308) xfsrefcountrecovercowleftovers (fs/xfs/libxfs/xfsrefcount.c:2113) xfsreflinkrecovercow (fs/xfs/xfsreflink.c:1085) xlogrecoverfinish (fs/xfs/xfslogrecover.c:3551) xfsmountfs (fs/xfs/xfsmount.c:1158) xfsfsfillsuper (fs/xfs/xfssuper.c:1940) gettreebdevflags (fs/super.c:1634) vfsgettree (fs/super.c:1694) path_mount (fs/namespace.c:4161) _x64sysmount (fs/namespace.c:4367) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) The buggy address belongs to the cache xfsrtrefcountbtcur of size 216 The buggy address is located 8 bytes to the right of allocated 216-byte region [ffff888018391578, ffff888018391650) Kernel panic - not syncing: Fatal exception