Executive brief
The Linux XFS filesystem contains a bug in its filesystem repair routines where a null pointer can be dereferenced during AGI (allocation group inode) buffer repair. An attacker or system administrator with local access to a filesystem with a corrupted AGI buffer could trigger a kernel crash (denial of service) or potentially execute arbitrary code with kernel privileges.
Technical details
The vulnerability is a null pointer dereference in the xrep_iunlink_walk_ondisk_bucket function within fs/xfs/scrub/agheader_repair.c. The code attempts to access sc->sa.agi_bp->b_addr, but agi_bp can be null if the buffer verifier fails during inspection. The fix replaces the reference with ragi->agi_bp, which skips verifier checks and is guaranteed to be valid. The bug affects the XFS filesystem repair code path, specifically when rebuilding unlinked inode lists in the allocation group inode metadata. This is a kernel-level issue requiring local filesystem access to trigger; the vulnerability was introduced in Linux 6.10 and fixed via stable backports.
Affected products
- Linux Linux kernel v6.10 and later
Timeline
- 2026-08-26: disclosed: CVE-2026-80533 published