High 7.8Published Feb 18, 2026

CVE-2026-23223xfs: fix UAF in xchk_btree_check_block_owner

Updated under an hour ago (Oct 27, 2026, 8:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ec793e690f801d97a7ae2a0d429fea1fee4d44aa before 1d411278dda293a507cb794db7d9ed3511c685c6; from ec793e690f801d97a7ae2a0d429fea1fee4d44aa before ed82e7949f5cac3058f4100f3cd670531d41a266; from ec793e690f801d97a7ae2a0d429fea1fee4d44aa before ba5264610423d9653aa36920520902d83841bcfd; from ec793e690f801d97a7ae2a0d429fea1fee4d44aa before 1c253e11225bc5167217897885b85093e17c2217	CNA record
linux linux_kernel linux:linux_kernel	from 6.9 before 6.12.72; from 6.13 before 6.18.11; from 6.19 before 6.19.1	NVD

References

References

https://git.kernel.org/stable/c/1d411278dda293a507cb794db7d9ed3511c685c6	patch
https://git.kernel.org/stable/c/ed82e7949f5cac3058f4100f3cd670531d41a266	patch
https://git.kernel.org/stable/c/ba5264610423d9653aa36920520902d83841bcfd	patch
https://git.kernel.org/stable/c/1c253e11225bc5167217897885b85093e17c2217	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.