Heimdall Security Logo

CVE-2026-80806

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <da32af420d6d466e247c43ac0b829edeac7ae0ad, 7.2.1, <=6.1.*, 7.1.11, <=6.12.*, <5959cad3cfa852ec07bbdaf9c17f4838a94a8e6c, 6.6.156, 5.10.269, 0, <5.8, <=7.1.*, <e27bae352158c007143d5bb50f3af33a177c0a37, <=5.10.*, <f53b325068bca0b238c3e0d2eb7de9b1f2268cab, <=6.6.*, <add98959b220935b243170214c787bc03044a44d, <=6.18.*, <458776af0061afec1014cb3cd0061e282e482e83, 043546e46dc70c25ff7e2cf6d09cbb0424fc9978, 6.18.47, <=7.2.*, 5.15.220, <ed1cd834da65db127f1c30ff67e78f14825a06c1, <a13f61ba9b2a7a4ff1f140949ccfad23c5313757, <=*, <=5.15.*, 6.12.108, 5.8, <3392391b363a63ebb531d45318a729b1c998565b, 6.1.187, 7.3

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made before EXT4_INODE_ENCRYPT is set. As a result, it can set S_DAX if the filesystem is mounted with "-o dax=always". EXT4_INODE_ENCRYPT then actually gets set a bit later in __ext4_new_inode(), when it calls fscrypt_set_context() which calls ext4_set_context(). ext4_set_context() sets EXT4_INODE_ENCRYPT and calls ext4_set_inode_flags(inode, init=false) to set S_ENCRYPTED too. This was intended to clear S_DAX as well. However, this was broken by commit 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load"). This causes data written to the file to bypass encryption, also causing xfstests failures such as generic/548 (when "-o dax=always" is used). Fix this by simplifying the flow by making __ext4_new_inode() set EXT4_INODE_ENCRYPT earlier. This makes it take effect in ext4_set_inode_flags(inode, init=true), making S_DAX never be set. Similarly, make EXT4_STATE_MAY_INLINE_DATA never be set in the first place on new encrypted inodes. Then it doesn't need to be cleared. As a result of these simplifications, ext4_set_context() no longer needs to change inode flags or state when 'handle != NULL'. Remove that too.

Gravité et risque d'exploitation

CVE-2026-80806 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.17 %, ce qui la place devant 6.4 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <da32af420d6d466e247c43ac0b829edeac7ae0ad, 7.2.1, <=6.1.*, 7.1.11, <=6.12.*, <5959cad3cfa852ec07bbdaf9c17f4838a94a8e6c, 6.6.156, 5.10.269, 0, <5.8, <=7.1.*, <e27bae352158c007143d5bb50f3af33a177c0a37, <=5.10.*, <f53b325068bca0b238c3e0d2eb7de9b1f2268cab, <=6.6.*, <add98959b220935b243170214c787bc03044a44d, <=6.18.*, <458776af0061afec1014cb3cd0061e282e482e83, 043546e46dc70c25ff7e2cf6d09cbb0424fc9978, 6.18.47, <=7.2.*, 5.15.220, <ed1cd834da65db127f1c30ff67e78f14825a06c1, <a13f61ba9b2a7a4ff1f140949ccfad23c5313757, <=*, <=5.15.*, 6.12.108, 5.8, <3392391b363a63ebb531d45318a729b1c998565b, 6.1.187, 7.3) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE