PT-2026-26099 · Linux+1 · Linux Kernel+1

Jiaming Zhang · Published 2026-01-01 · Updated 2026-05-21 · CVE-2026-23249

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the XFS file system related to the revalidation of two btrees during file system repair. Specifically, the issue arises when rebuilding both the free space and inode btrees concurrently. The first btree revalidation can nullify a cursor required by the second revalidation, leading to a null pointer dereference and a system crash. This occurs because the first call to xchk allocbt() nullifies the cursor needed by the second call. The issue affects the xrep revalidate allocbt() function, which is called through a chain including xfs file ioctl(), xfs ioc scrubv metadata(), and xfs scrub metadata(). The function sc->ops->repair eval(sc) is also involved. The vulnerability is triggered when the first btree revalidation fails on a cross-reference attempt, resulting in the deletion of the cursor used by the second btree. The same issue also affects the xrep revalidate iallocbt function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-03582

CVE-2026-23249

Affected Products

Linux Kernel

Xfs

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23249.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2026-23249 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23249 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23249 · Vendor Advisory
• https://git.kernel.org/stable/c/5991e96f2ae82df60a3e4ed00f3432d9f3502a99 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23249 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03582 · Security Note
• https://git.kernel.org/stable/c/b04baa848c0543b240b1bd8aecff470382f6f154 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23249 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-50260.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23249 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23249 · Vendor Advisory
• https://git.kernel.org/stable/c/55e03b8cbe2783ec9acfb88e8adb946ed504e117 · Patch
• https://git.kernel.org/stable/c/d69de525bc7ab27713342080bf50826df3f6a68f · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23249 · Vendor Advisory