CVE-2026-80591 f2fs: fix listxattr handling of corrupted xattr entries
A flaw in the Linux kernel's f2fs filesystem allows attackers to cause a denial of service by triggering improper handling of corrupted extended attribute entries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80591?
CVE-2026-80591 is a high-severity denial of service vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix listxattr handling of corrupted xattr entries
Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result.
Which versions are affected by CVE-2026-80591?
How do I fix CVE-2026-80591?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80591 being exploited?
There is no known exploitation of CVE-2026-80591 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80591, DEBIAN-CVE-2026-80591, GHSA-4pj6-ggmx-ccvm, UBUNTU-CVE-2026-80591.