Executive brief
A vulnerability in the Linux kernel's XFS file system could allow a local user to crash the system. The issue occurs during specific file system repair or 'scrub' operations, where the system incorrectly handles memory cleanup. This can lead to a system failure (denial of service), potentially disrupting operations or causing data in memory to be lost.
Technical details
A NULL pointer dereference (CWE-476) exists in the XFS file system's scrub and repair functionality. The vulnerability is triggered when the kernel attempts to call destructors (xfarray_destroy or xfblob_destroy) on pointers that have not been properly initialized or have already been freed, specifically within agheader_repair.c, attr_repair.c, dir_repair.c, dirtree.c, and nlinks.c. A local attacker with sufficient privileges to initiate file system scrub or repair operations can exploit this to cause a kernel oops and subsequent system crash (Denial of Service). The fix ensures that destructors are only called on valid pointers and that those pointers are nullified after destruction. Patches are available in various stable kernel branches including 6.12.75, 6.18.16, and 6.19.6.
Affected products
- Linux Linux Kernel 6.9 to 6.12.74, 6.13 to 6.18.15, 6.19 to 6.19.5
Timeline
- 2026-03-18: advisory: Initial CVE publication
- 2026-01-23: patched: Initial fix authored by Darrick J. Wong
- 2026-05-21: other: NVD analysis and enrichment completed