Executive brief
A vulnerability in the Linux kernel's XFS file system could allow a local user to crash the system. The issue occurs during file system repair operations when the system attempts to fix internal data structures (btrees). If a repair fails in a specific way, the system may attempt to access memory that has already been cleared, leading to a system crash and potential denial of service.
Technical details
A NULL pointer dereference exists in the XFS scrub and repair subsystem, specifically within the xrep_revalidate_allocbt and xrep_revalidate_iallocbt functions. When rebuilding free space or inode btrees, the kernel performs a two-step revalidation. If the first revalidation (e.g., BNOBT) fails during cross-referencing, it may nullify the cursor required for the second revalidation (e.g., CNTBT). Subsequent access to this nullified cursor in the second call leads to a kernel panic. This can be triggered via XFS_IOC_SCRUBV_METADATA ioctl calls. Patches have been released for various stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.8 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-23: patched: Initial patch authored by Darrick J. Wong
- 2026-03-18: disclosed: CVE-2026-23249 published