CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: fail recovery on a committed log item with no regions<br /> <br /> If the first op of a transaction is a bare transaction header<br /> (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()<br /> adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and<br /> ri_buf == NULL.<br /> <br /> The header can be split across op records, so later ops may still add<br /> regions; the item is only invalid if the transaction commits with none.<br /> The runtime commit path never emits such a transaction, so this only<br /> happens on a crafted log. It came from an AI-assisted code audit of the<br /> recovery parser.<br /> <br /> xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads<br /> *(unsigned short *)item-&gt;ri_buf[0].iov_base and faults on the NULL<br /> ri_buf. Reject it there, before the commit handlers that also read<br /> ri_buf[0].<br /> <br /> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]<br /> RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)<br /> xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)<br /> xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)<br /> xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)<br /> xlog_recover (fs/xfs/xfs_log_recover.c:3493)<br /> xfs_log_mount (fs/xfs/xfs_log.c:618)<br /> xfs_mountfs (fs/xfs/xfs_mount.c:1034)<br /> xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)<br /> vfs_get_tree (fs/super.c:1695)<br /> path_mount (fs/namespace.c:4161)<br /> __x64_sys_mount (fs/namespace.c:4367)