CVE-2026-80591

The f2fs filesystem implementation in the Linux kernel failed to validate extended-attribute (xattr) entries in f2fs_listxattr() before reading their fields, so a corrupted xattr entry located outside the valid xattr storage area was processed instead of being rejected. The flaw is triggered when a low-privileged local user lists extended attributes on an f2fs filesystem whose on-disk xattr metadata is corrupted. The kernel then reads entry data beyond the valid xattr area; the CVSS 3.1 vector rates confidentiality, integrity, and availability impact as high, indicating potentially serious consequences such as kernel memory disclosure, corruption, or a crash. Only systems running Linux kernels that use the f2fs filesystem are affected; the advisory does not specify which kernel version ranges are vulnerable. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known.

What to do: Update affected systems to a kernel package from your distribution that includes the f2fs listxattr validation fix. Prioritize only hosts where f2fs is actually in use (check with 'df -T' or 'lsblk -f'), and run an fsck/f2fs check on f2fs volumes to repair corrupted xattr metadata. No workaround is described, so restricting untrusted local shell access on f2fs hosts is the main interim risk reduction.