PT-2026-61640 · Linux · Linux
CVE-2026-64187
·
Publicado
2026-07-20
·
Atualizado
2026-07-20
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
xfs: fail recovery on a committed log item with no regions
If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs trans header)), xlog recover add to trans()
adds an item but no region, leaving it on r itemq with ri cnt == 0 and
ri buf == NULL.
The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log. It came from an AI-assisted code audit of the
recovery parser.
xlog recover reorder trans() calls ITEM TYPE() on the item, which reads
*(unsigned short *)item->ri buf[0].iov base and faults on the NULL
ri buf. Reject it there, before the commit handlers that also read
ri buf[0].
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:xlog recover reorder trans (fs/xfs/xfs log recover.c:1836)
xlog recover commit trans (fs/xfs/xfs log recover.c:2043)
xlog recover process data (fs/xfs/xfs log recover.c:2501)
xlog do recovery pass (fs/xfs/xfs log recover.c:3244)
xlog recover (fs/xfs/xfs log recover.c:3493)
xfs log mount (fs/xfs/xfs log.c:618)
xfs mountfs (fs/xfs/xfs mount.c:1034)
xfs fs fill super (fs/xfs/xfs super.c:1938)
vfs get tree (fs/super.c:1695)
path mount (fs/namespace.c:4161)
x64 sys mount (fs/namespace.c:4367)
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux