CVE-2026-64187
Received Received - Intake

Null Pointer Dereference in XFS Filesystem Recovery

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and ri_buf == NULL. The header can be split across op records, so later ops may still add regions; the item is only invalid if the transaction commits with none. The runtime commit path never emits such a transaction, so this only happens on a crafted log. It came from an AI-assisted code audit of the recovery parser. xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads *(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL ri_buf. Reject it there, before the commit handlers that also read ri_buf[0]. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:618) xfs_mountfs (fs/xfs/xfs_mount.c:1034) xfs_fs_fill_super (fs/xfs/xfs_super.c:1938) vfs_get_tree (fs/super.c:1695) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64187
EUVD
EUVD-2026-46007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel xfs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's XFS file system involves a flaw in log recovery handling. When a transaction header is malformed or crafted, it can lead to a null pointer dereference during recovery. Specifically, a transaction with no regions added to an item causes a crash when the recovery process tries to access memory that doesn't exist.

Detection Guidance

This vulnerability affects the XFS file system in the Linux kernel and is related to log recovery. Detection requires checking for kernel logs or crash reports indicating a null-pointer dereference in xlog_recover_reorder_trans or related XFS recovery functions. Monitor system logs for kernel panics or errors during XFS mount or recovery operations.

Impact Analysis

This vulnerability could cause a system crash or denial of service if an attacker crafts a malicious XFS log file. It primarily affects systems using the XFS file system during recovery operations, potentially leading to data unavailability or corruption.

Compliance Impact

This vulnerability is specific to the XFS file system in the Linux kernel and involves a null-pointer dereference during log recovery. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA. Compliance risks would only arise if this vulnerability were exploited to cause system crashes or data corruption, potentially leading to unauthorized access or loss of data integrity.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patching is not immediately possible, avoid mounting or using XFS file systems until the patch is applied. Ensure backups are current in case of filesystem corruption during recovery.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart