{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ext4: don't enable DAX on new encrypted files  Currently, when a new encrypted regular file is created, the call to ext4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made before EXT4_INODE_ENCRYPT is set.  As a result, it can set S_DAX if the filesystem is mounted with \"-o dax=always\".  EXT4_INODE_ENCRYPT then actually gets set a bit later in __ext4_new_inode(), when it calls fscrypt_set_context() which calls ext4_set_context().  ext4_set_context() sets EXT4_INODE_ENCRYPT and calls ext4_set_inode_flags(inode, init=false) to set S_ENCRYPTED too.  This was intended to clear S_DAX as well.  However, this was broken by commit 043546e46dc7 (\"fs/ext4: Only change S_DAX on inode load\").  This causes data written to the file to bypass encryption, also causing xfstests failures such as generic/548 (when \"-o dax=always\" is used).  Fix this by simplifying the flow by making __ext4_new_inode() set EXT4_INODE_ENCRYPT earlier.  This makes it take effect in ext4_set_inode_flags(inode, init=true), making S_DAX never be set.  Similarly, make EXT4_STATE_MAY_INLINE_DATA never be set in the first place on new encrypted inodes.  Then it doesn't need to be cleared.  As a result of these simplifications, ext4_set_context() no longer needs to change inode flags or state when 'handle != NULL'.  Remove that too.",
  "id": "DEBIAN-CVE-2026-80806",
  "modified": "2026-09-14T16:47:46.959405925Z",
  "published": "2026-09-04T16:18:07.647Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80806"
    }
  ],
  "upstream": [
    "CVE-2026-80806"
  ]
}