{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  xfs: fix off-by-one in rtrefcount btree root level validation  xfs_rtrefcountbt_compute_maxlevels() sets  \tmp-\u003em_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;  where the trailing \"+ 1\" already accounts for the inode-root level, so the deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must satisfy bc_nlevels \u003c= bc_maxlevels (= m_rtrefc_maxlevels).  The two on-disk validation paths, xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount(), check the root level with \"\u003e\" instead of \"\u003e=\", so a crafted rtreflink (metadir + realtime + reflink) image whose /rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1, exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, the first btree op on such a cursor indexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is reached by the first rtrefcount cursor built after mount, via log/CoW recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an FS_IOC_GETFSMAP over the realtime device.  Reject a root level equal to m_rtrefc_maxlevels, matching the \"\u003e=\" form already used by the sibling data-device refcount/rmap verifiers and the in-memory rtrmap verifier.    BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)   Write of size 2 at addr ffff888018391658 by task exploit/144    xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101)    xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308)    xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113)    xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085)    xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551)    xfs_mountfs (fs/xfs/xfs_mount.c:1158)    xfs_fs_fill_super (fs/xfs/xfs_super.c:1940)    get_tree_bdev_flags (fs/super.c:1634)    vfs_get_tree (fs/super.c:1694)    path_mount (fs/namespace.c:4161)    __x64_sys_mount (fs/namespace.c:4367)    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)   The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216   The buggy address is located 8 bytes to the right of    allocated 216-byte region [ffff888018391578, ffff888018391650)   Kernel panic - not syncing: Fatal exception",
  "id": "DEBIAN-CVE-2026-80537",
  "modified": "2026-09-14T16:47:35.305770446Z",
  "published": "2026-08-26T15:17:07.890Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80537"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-80537"
  ]
}