# CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN


- **Severity:** High 7.1 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 26 Aug 2026
- **Updated:** 16 Oct 2026
- **Also known as:** BELL-CVE-2026-80530, DEBIAN-CVE-2026-80530, GHSA-qxc6-78q3-77vp, UBUNTU-CVE-2026-80530

## What is CVE-2026-80530?

CVE-2026-80530 is a high-severity vulnerability in Linux, published on 26 Aug 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

When exchanging two full-file ranges, xmi_can_exchange_reflink_flags()
can move the reflink inode flag from the file that currently has it to
the other file, as long as exactly one side is marked.  This assumes
that the file contents, and therefore all shared extents, are exchanged.

That assumption is not true when XFS_EXCHMAPS_INO1_WRITTEN is set.
xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings
from file1, so an exchange can complete without moving every mapping
that the earlier flag-swap decision accounted for.  In that case the
post-operation cleanup can clear the reflink flag from an inode that
still owns shared written extents.  Later writes then take the
non-reflink write path and may update blocks that should still have
been protected by CoW, which shows up as data corruption between
reflink-related files.

Fix this by disabling the reflink flag exchange whenever
XFS_EXCHMAPS_INO1_WRITTEN is requested.  The contents exchange can still
proceed; the conservative outcome is that both inodes keep the reflink
flag.  The regular reflink flag cleanup path can drop the extra flag
later once the inode no longer has shared extents.

## Which versions are affected by CVE-2026-80530?


## How do I fix CVE-2026-80530?

Upgrade to a fixed version.

## Is CVE-2026-80530 being exploited?

There is no known exploitation of CVE-2026-80530 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-80530 and fix it if it is affected.

What it is: CVE-2026-80530 is a high-severity vulnerability in Linux, published on 26 Aug 2026. 
Exploitation: There is no known exploitation of CVE-2026-80530 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-80530/ (Markdown: https://insights.sbomify.com/CVE-2026-80530/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-80530
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80530
- OSV: https://osv.dev/vulnerability/CVE-2026-80530

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-80530/
Summaries are generated and may contain mistakes; the official description above is the record.