Linux XFS flaw lets local users overwrite files for root

A local privilege escalation in the Linux kernel's XFS filesystem lets an ordinary user arbitrarily overwrite the on-disk contents of any readable file, including /etc/passwd and root-owned setuid binaries, and thereby reach root.

Tracked as CVE-2026-80530 and called XFSTango by its discoverer, the bug sits in the XFS_IOC_EXCHANGE_RANGE path. When a range exchange is performed with a written-data flag set, the kernel can clear the reflink marker from an inode that still shares blocks with another file. Later writes then bypass copy-on-write protection, corrupting data that was supposed to remain shared and isolated.

Lin Jiapeng reported the issue on the oss-security list. The flawed flag handling first appeared in Linux 6.10 and has been corrected upstream. Exploitation is deterministic, needs only low-privilege local access, and requires no user interaction. The flaw carries a CVSS 3.1 base score of 7.1 (High).