xfs: validate attr entry pointer before field access (Linux Linux)

CVE-2026-80805
Not available

At a glance

Source
NVD
EPSS
EPSS 0.19 % · percentile 9 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed. Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access.

References

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected c84760659dcf237902d4cc997cd5f55cb3b2807f < 0f82586741e39926542f621bafa424e237a04fa4 ; affected c84760659dcf237902d4cc997cd5f55cb3b2807f < 134d82a2b5e3eba3ebf58753a1387b22f26ca1de ; affected c84760659dcf237902d4cc997cd5f55cb3b2807f < 03a12253dd2a036545bdb0110a4e0b8dc70f8e7c ; affected c84760659dcf237902d4cc997cd5f55cb3b2807f < e99120b5944a16d0bc27e52b33de78bcdaaabf5c ; affected c84760659dcf237902d4cc997cd5f55cb3b2807f < 98a42bb9d60d42898c3494de351a1bf508348cde ; affected c84760659dcf237902d4cc997cd5f55cb3b2807f < 184c1a80421a5b5ddcd262e47980ce2e67fee211
Linux · Linuxaffected 5.5 ; unaffected 0 < 5.5 ; unaffected 5.10.267 ≤ 5.10.* ; unaffected 5.15.218 ≤ 5.15.* ; unaffected 6.1.185 ≤ 6.1.* ; unaffected 6.6.154 ≤ 6.6.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD