What’s Vulnerable › Vulnerabilities

CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-08-26

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this case, it's not correct for the directory tree repair code to try to iolock/ilock both sc->ip and dp, because they're the same inode. Fix this by detecting that corner case and handling it appropriately.

Affected products

• Linux kernel: 6.10 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/17bc347cbdfb125eddac0a815b1f6c1f6eb56676
• https://git.kernel.org/stable/c/5fc643fb86599e29b38e7b2c2680b4b15bf8f772
• https://git.kernel.org/stable/c/c575904471570e69bce40fa638365c6c0403e2ff
• https://git.kernel.org/stable/c/ce2a7006ec5ed88db1b1669124ec85bc1714ccaa

Get alerted when CVE-2026-80535 or the next vulnerability affects your stack