Executive brief
A vulnerability was identified in the Linux kernel's XFS file system component, which is responsible for managing high-performance data storage. Under certain conditions, the system could fail to allocate memory during file system maintenance or debugging tasks, potentially leading to a system crash or denial of service. This issue primarily affects system stability and availability rather than direct data exposure.
Technical details
A vulnerability in the XFS file system's 'scrub' functionality stems from the use of the 'kasprintf' function within 'xchk_xfile_*_descr' macros. These macros are used to generate descriptive strings for debugging aids. If a formatted string exceeds the memory allocation guarantees (typically 16 bytes in certain kernel contexts), 'kasprintf' can fail to allocate memory, leading to a kernel failure or crash. An attacker with local access could potentially trigger this path to cause a denial of service. The fix involves replacing dynamic string generation with static strings to eliminate the allocation failure path. The issue affects various kernel versions between 6.6 and 6.14.
Affected products
- Linux Linux Kernel 6.6 to 6.14; 6.10 to 6.12.78; 6.13 to 6.18.16; 6.19 to 6.19.6
Timeline
- 2026-03-18: advisory: Initial disclosure of CVE-2026-23252
- 2026-03-18: disclosed
- 2026-01-23: patched: Initial patch authored by Darrick J. Wong