Executive brief
The Linux kernel's XFS filesystem contains a bug in buffer management that can cause a kernel crash when memory allocation fails. When the system tries to free a buffer that failed to allocate backing memory, it attempts to dereference a NULL pointer, causing an immediate kernel panic and system outage.
Technical details
The vulnerability is a NULL pointer dereference in the xfs_buf_free() function in fs/xfs/xfs_buf.c. When xfs_buf_alloc_backing_mem() fails during buffer allocation, xfs_buf_free() is invoked with bp->b_addr still NULL. The code falls through to the folio_put path, which calls virt_to_folio(NULL), dereferencing an invalid address. The fix adds a NULL check (`else if (bp->b_addr)`) before calling folio_put(), preventing the dereference when the address is NULL. This is a local availability issue triggered during XFS repair operations or buffer allocation failures, requiring no network access or user interaction.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 6.x and later
Timeline
- 2026-08-22: disclosed: Published in NVD
- 2026-07-19: patched: Upstream commit d852729c5f4f830fbe7413df032e29459b3daf83 by Yun Zhou