Executive brief
A vulnerability in the Linux kernel's XFS file system could allow a local user to cause a system crash. The issue occurs during file system 'scrub' operations, which are used to check and repair data integrity. If the system runs out of memory during this process, the kernel may fail to handle the error correctly, leading to a system failure.
Technical details
A NULL pointer dereference vulnerability exists in the XFS file system component of the Linux kernel. The function 'xchk_scrub_create_subord' incorrectly returned a mangled ENOMEM error instead of NULL when memory allocation failed via 'kzalloc'. Consequently, calling functions in 'fs/xfs/scrub/common.c' and 'fs/xfs/scrub/repair.c' failed to properly validate the return value, leading to a dereference of an invalid pointer. An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). Patches have been released for various stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.2 to 6.10, 6.12, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-03-18: advisory: Initial CVE publication
- 2026-01-23: patched: Fix authored by Darrick J. Wong
- 2026-05-21: other: NIST analysis and CPE enrichment completed