CVE-2026-80809: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-4q7v-w8cm-5gq2
Share
Published
Advisory Summary

CVE-2026-80809 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-80809 at a Glance

CVE Identifier CVE-2026-80809
GHSA Identifier GHSA-4q7v-w8cm-5gq2
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-80809

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-80809, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs [BUG] lsetxattr() panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block. [CAUSE] ocfs2_calc_xattr_set_need() never reserves metadata blocks for a new xattr value's extent tree when the file already has an external xattr block. The not_found path leaves meta_add at zero, so meta_ac is NULL when ocfs2_xattr_extend_allocation() runs. A new value root has room for a single extent record. On a fragmented filesystem, the allocator cannot satisfy the xattr value in one contiguous run, so each non-contiguous run requires its own extent record. When the value root's extent list is full and meta_ac is NULL, ocfs2_add_clusters_in_btree() returns RESTART_META, and ocfs2_xattr_extend_allocation() hits BUG_ON(why == RESTART_META). [FIX] The case where no xattr block exists yet already calls ocfs2_extend_meta_needed(&def_xv.xv.xr_list) to reserve value tree metadata. Add the same reservation to the case where an xattr block already exists, making the two cases consistent. Replace the BUG_ON with a -ENOSPC return so that if RESTART_META is returned despite the reservation, the error propagates to userspace instead of panicking the kernel.

References

NVD — CVE-2026-80809 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80809
git.kernel.org/stable/c/04ba24bce6... WEB
https://git.kernel.org/stable/c/04ba24bce61c917b5b3009f0db470cbb72e26a0d
git.kernel.org/stable/c/0cdc7dde00... WEB
https://git.kernel.org/stable/c/0cdc7dde00ec63ac714271fa8b2918d630b8da1a
git.kernel.org/stable/c/50f0cbec45... WEB
https://git.kernel.org/stable/c/50f0cbec45b0f3fd7e1263d01916518dbf31eb3f
git.kernel.org/stable/c/6176313622... WEB
https://git.kernel.org/stable/c/6176313622e34fa3e2b66b9d0682d1e1c6b365c5
git.kernel.org/stable/c/6a009f1e61... WEB
https://git.kernel.org/stable/c/6a009f1e61b11d9e23d3c5aa1dacfb010945da45
git.kernel.org/stable/c/743ac90828... WEB
https://git.kernel.org/stable/c/743ac908282ac97ef6e73ac3a92df2cc8ecb7479
git.kernel.org/stable/c/a3ccb57086... WEB
https://git.kernel.org/stable/c/a3ccb57086dd7652d5ecb826486144198a98a8e9
git.kernel.org/stable/c/b4663405ae... WEB
https://git.kernel.org/stable/c/b4663405ae29d36011cd712d243456f3f9ab700d
git.kernel.org/stable/c/b9eb5c9fdd... WEB
https://git.kernel.org/stable/c/b9eb5c9fdd81d82976d4d5be2b2458eb7d7e46ec

Frequently Asked Questions

What is CVE-2026-80809?
CVE-2026-80809 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-80809?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-80809?
CVE-2026-80809 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-80809?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4q7v-w8cm-5gq2",
  "modified" : "2026-09-04T18:31:27Z",
  "published" : "2026-09-04T18:31:27Z",
  "aliases" : [ "CVE-2026-80809" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix missing metadata reservation for large xattrs\n\n[BUG]\nlsetxattr() panics the kernel when setting a large xattr value on a\nfragmented filesystem where the file already has an external xattr\nblock.\n\n[CAUSE]\nocfs2_calc_xattr_set_need() never reserves metadata blocks for a new\nxattr value's extent tree when the file already has an external xattr\nblock. The not_found path leaves meta_add at zero, so meta_ac is NULL\nwhen ocfs2_xattr_extend_allocation() runs.\n\nA new value root has room for a single extent record. On a fragmented\nfilesystem, the allocator cannot satisfy the xattr value in one\ncontiguous run, so each non-contiguous run requires its own extent\nrecord. When the value root's extent list is full and meta_ac is NULL,\nocfs2_add_clusters_in_btree() returns RESTART_META, and\nocfs2_xattr_extend_allocation() hits BUG_ON(why == RESTART_META).\n\n[FIX]\nThe case where no xattr block exists yet already calls\nocfs2_extend_meta_needed(&def_xv.xv.xr_list) to reserve value tree\nmetadata. Add the same reservation to the case where an xattr block\nalready exists, making the two cases consistent.\n\nReplace the BUG_ON with a -ENOSPC return so that if RESTART_META is\nreturned despite the reservation, the error propagates to userspace\ninstead of panicking the kernel.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80809"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/04ba24bce61c917b5b3009f0db470cbb72e26a0d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0cdc7dde00ec63ac714271fa8b2918d630b8da1a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/50f0cbec45b0f3fd7e1263d01916518dbf31eb3f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6176313622e34fa3e2b66b9d0682d1e1c6b365c5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6a009f1e61b11d9e23d3c5aa1dacfb010945da45"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/743ac908282ac97ef6e73ac3a92df2cc8ecb7479"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a3ccb57086dd7652d5ecb826486144198a98a8e9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b4663405ae29d36011cd712d243456f3f9ab700d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b9eb5c9fdd81d82976d4d5be2b2458eb7d7e46ec"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-04T16:18:08Z"
  }
}