CVE-2026-80899
In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a local filesystem and has an kernel-defined caching hierarchy which could be inflexible compared to the fanotify pre-content hooks. Therefore, this feature has been deprecated for almost two years. As EROFS file-backed mounts and fanotify pre-content hooks both upstream for a while and already providing equivalent functionality (erofs-utils has supported fanotify pre-content hooks), let's remove the fscache backend now. The main application of this feature is Nydus [1], and they plan to move to use fanotify pre-content hooks in the near future too. I hope this patch can be merged into Linux 7.2, which is also motivated by newly found implementation issues [2][3] that are not worth investigating given the deprecation and limited development resources. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later: it seems fine since the codebase is isolated by CONFIG_CACHEFILES_ONDEMAND. [1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md [2] https://github.com/dragonflyoss/nydus/pull/1824 [3] https://lore.kernel.org/r/[email protected]
Affected versions
Linux kernel versions
6.9
and later are affected. Fixed in
7.1.8,
7.2
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-80899?
CVE-2026-80899 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.9 onward and has been patched in 7.1.8 and 7.2. CVE-2026-80899 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80899?
Yes. CVE-2026-80899 has been patched. Fixed versions include 7.1.8 and 7.2. If you are running Linux kernel 6.9 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80899 actively exploited?
No. CVE-2026-80899 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.