Medium 5.5Published Jul 20, 2026

CVE-2026-64187xfs: fail recovery on a committed log item with no regions

Updated under an hour ago (Oct 27, 2026, 6:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and ri_buf == NULL. The header can be split across op records, so later ops may still add regions; the item is only invalid if the transaction commits with none. The runtime commit path never emits such a transaction, so this only happens on a crafted log. It came from an AI-assisted code audit of the recovery parser. xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads *(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL ri_buf. Reject it there, before the commit handlers that also read ri_buf[0]. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:618) xfs_mountfs (fs/xfs/xfs_mount.c:1034) xfs_fs_fill_super (fs/xfs/xfs_super.c:1938) vfs_get_tree (fs/super.c:1695) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367)

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 89cebc8477290b152618ffa110bbeae340d50900 before 5105426424ad6981db827cc1ada835a488fab035; from 89cebc8477290b152618ffa110bbeae340d50900 before 226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4; from 89cebc8477290b152618ffa110bbeae340d50900 before d0ae7ec3aa61db5140b107f0a63e017f63e56a96; from 89cebc8477290b152618ffa110bbeae340d50900 before d50b1fd066d66ceb548ba43e332cfe8a47e5e55a; from 89cebc8477290b152618ffa110bbeae340d50900 before d98f22d2e11e0a36493aeb25b2933571ee90d9a4; from 89cebc8477290b152618ffa110bbeae340d50900 before cccbabeb9a18fcb978d76d6047f2b59214aa7749; from 89cebc8477290b152618ffa110bbeae340d50900 before 2094dab19d45c487285617b7b68913d0cc0c1211	CNA record
linux linux_kernel linux:linux_kernel	from 4.3 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; 7.2; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035	patch
https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4	patch
https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96	patch
https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a	patch
https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4	patch
https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749	patch
https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.