{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80734 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80734 is a high-severity vulnerability in Linux, published on 3 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80734 and fix it if it is affected.\n\nWhat it is: CVE-2026-80734 is a high-severity vulnerability in Linux, published on 3 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80734 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80734/ (Markdown: https://insights.sbomify.com/CVE-2026-80734/index.md)","id":"CVE-2026-80734","markdown":"https://insights.sbomify.com/CVE-2026-80734/index.md","name":"CVE-2026-80734","record":{"aliases":["BELL-CVE-2026-80734","DEBIAN-CVE-2026-80734","GHSA-rfxq-m8fc-mrw6","UBUNTU-CVE-2026-80734"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel btrfs","requires_auth":"low_privilege","summary":"A missing initialization of inode mapping flags in the Linux kernel btrfs filesystem can cause a kernel crash during file operations.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: initialize inode mapping flags for cached inodes\n\n[BUG]\nWhen running generic/795 with 8K block size, 4K page size, the test\nalways fails, triggering some ASSERT()s related to folio size:\n\n  795 (241074): drop_caches: 3\n  assertion failed: IS_ALIGNED(start, blocksize) \u0026\u0026 IS_ALIGNED(end + 1, blocksize), in extent_io.c:1404 (blocksize=8192 root=262 ino=258 start=16826368 end=16830463 mapping min order=0)\n  ------------[ cut here ]------------\n  kernel BUG at extent_io.c:1404!\n  Oops: invalid opcode: 0000 [#1] SMP\n  CPU: 8 UID: 0 PID: 241105 Comm: fsstress Tainted: G           OE       7.2.0-rc5-custom+ #442 PREEMPT(full)  f4bfb352566f3949f29c233ce6f735050a03b245\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:assert_folio_range.cold+0x3d/0x3f [btrfs]\n  Call Trace:\n   \u003cTASK\u003e\n   btrfs_read_folio+0x9e/0x170 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n   prepare_one_folio.constprop.0+0x104/0x2a0 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n   btrfs_buffered_write+0x285/0xa50 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n   btrfs_do_write_iter+0x1aa/0x210 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n   iter_file_splice_write+0x31a/0x540\n   direct_splice_actor+0x53/0x170\n   splice_direct_to_actor+0xe9/0x240\n   do_splice_direct+0x76/0xb0\n   vfs_copy_file_range+0x1fd/0x630\n   __x64_sys_copy_file_range+0xf9/0x220\n   do_syscall_64+0xe1/0x790\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---\n\nThe ASSERT() itself is added by a later patch.\nThe crash is triggered with that new debug patch, and without this fix.\n\n[CAUSE]\nIn the above case, the start 16826368 is properly 8K aligned, but the\nend (16830463 + 1) is not 8K aligned.\nFurthermore the mapping's minimal folio order is 0, not the expected 1\nfor 8K block size with 4K page size.\n\nSo this means some inodes do not have btrfs_set_inode_mapping_order()\ncalled on it.\n\nThe missing btrfs_set_inode_mapping_order() call happens for cached\ninodes, through the following events:\n\n- btrfs_create_new_inode() called for inode X\n  Which properly sets minimal folio order for the VFS inode.\n\n- btrfs_update_inode() called for inode X\n  Which calls btrfs_delayed_update_inode() to create a delayed_node\n  into root-\u003edelayed_nodes xarray.\n\n- Drop cache/memory pressure, evicting in-memory inode X\n  Which evicted the inode X, but delayed_node is still in\n  root-\u003edelayed_nodes for future reuse.\n\n- btrfs_iget() for inode X called again\n\n  btrfs_iget()\n  |- btrfs_iget_locked()\n  |  |- iget5_locked_rcu()\n  |     Which creates a new vfs_inode for btrfs, whose mapping still\n  |     has the minimal order as 0.\n  |\n  |- btrfs_read_locked_inode()\n     |- btrfs_fill_inode()\n     |  |- btrfs_get_delayed_node()\n     |     Which found out the previous node, and use that delayed\n     |     node to initialize the new inode.\n     |\n     |- filled = true;\n     |- if (filled) goto cache_index;\n        Which skips the btrfs_update_inode_mapping_flags() and\n\tbtrfs_set_inode_mapping_order() calls.\n\tSo the inode still has minimal folio order set as 0, not\n\tthe required 1.\n\nThus later page cache read will get a folio whose size is smaller than\nblock size, as the mapping has its minimal folio order set as 0 not 1,\nthen trigger the ASSERT().\n\n[FIX]\nMove the btrfs_update_inode_mapping_flags() and\nbtrfs_set_inode_mapping_order() calls under cache_index label,\nso that the mapping flags and minimal folio order is always set\nno matter if we have a cached inode.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"btrfs: initialize inode mapping flags for cached inodes","id":"CVE-2026-80734","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"ovpn: ensure socket is owned by ovpn before deref sk_user_data","id":"CVE-2026-80735"},"packages":[],"prev":{"headline":"net: remove WARN_ON_ONCE() from sk_mc_loop()","id":"CVE-2026-80733"},"products":["Linux"],"published":"2026-09-03","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A missing initialization of inode mapping flags in the Linux kernel btrfs filesystem can cause a kernel crash during file operations.","url":"https://insights.sbomify.com/CVE-2026-80734/"}