Executive brief
A vulnerability was identified in the Linux kernel's XFS file system component. A specially crafted file system log could cause the system to crash (kernel panic) when attempting to mount or recover the file system. This issue primarily affects system availability and could be used in a denial-of-service attack by a user with the ability to mount malicious storage devices or disk images.
Technical details
A null pointer dereference exists in the XFS log recovery subsystem of the Linux kernel. The vulnerability occurs in xlog_recover_reorder_trans() when processing a committed log item that contains a bare transaction header but no subsequent regions. This state results in a NULL ri_buf pointer, which is later dereferenced by the ITEM_TYPE() macro. An attacker can trigger this by providing a specially crafted XFS log, typically during a mount operation. The issue was identified via AI-assisted code audit and has been resolved by adding validation to reject log items with no regions during the reordering phase of recovery. patches are available in various stable kernel branches.
Affected products
- Linux Linux Kernel 4.3 to 6.12.96, 6.18.39
Timeline
- 2026-07-02: disclosed: Initial patch submission
- 2026-07-08: patched: Patch committed to stable tree
- 2026-07-20: advisory: CVE published