CVE-2026-64187 - Vulnerability Details

- xfs: fail recovery on a committed log item with no regions

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fail recovery on a committed log item with no regions

If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.

The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log. It came from an AI-assisted code audit of the
recovery parser.

xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf. Reject it there, before the commit handlers that also read
ri_buf[0].

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
xlog_recover (fs/xfs/xfs_log_recover.c:3493)
xfs_log_mount (fs/xfs/xfs_log.c:618)
xfs_mountfs (fs/xfs/xfs_mount.c:1034)
xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
vfs_get_tree (fs/super.c:1695)
path_mount (fs/namespace.c:4161)
__x64_sys_mount (fs/namespace.c:4367)

Published: 2026-07-20

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a null‑pointer dereference in the XFS log recovery code. A crafted recovery log can contain a transaction header that the system interprets as a log item with no regions, causing xlog_recover_reorder_trans to dereference a NULL ri_buf and trigger a kernel crash. The consequence is a denial‑of‑service event that may bring the system to a halt, but it does not provide code execution or compromise of confidentiality.

Affected Systems

All Linux kernel installations that use the XFS filesystem are affected. The issue resides in the core XFS code (fs/xfs/xfs_log_recover.c) and applies to any kernel version that includes the unpatched XFS implementation. Vendor notes list Linux:Linux, which means the fix is bundled in subsequent kernel releases.

Risk and Exploitability

The vulnerability has a medium severity score (CVSS 5.5) due to a kernel panic. Exploitation requires a crafted XFS log or an attacker who can influence the XFS journal, which implies local or root‑level access or the ability to forge a file system image. As there is no remote trigger, the attack vector is unlikely from the network. The EPSS score is < 1%, and the vulnerability is not currently listed in the CISA KEV catalog, but a kernel crash remains a significant issue.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`89cebc8477290b152618ffa110bbeae340d50900`	affected	< 5105426424ad6981db827cc1ada835a488fab035
`89cebc8477290b152618ffa110bbeae340d50900`	affected	< 226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4
`89cebc8477290b152618ffa110bbeae340d50900`	affected	< d0ae7ec3aa61db5140b107f0a63e017f63e56a96
`89cebc8477290b152618ffa110bbeae340d50900`	affected	< d50b1fd066d66ceb548ba43e332cfe8a47e5e55a
`89cebc8477290b152618ffa110bbeae340d50900`	affected	< d98f22d2e11e0a36493aeb25b2933571ee90d9a4
`89cebc8477290b152618ffa110bbeae340d50900`	affected	< cccbabeb9a18fcb978d76d6047f2b59214aa7749
`89cebc8477290b152618ffa110bbeae340d50900`	affected	< 2094dab19d45c487285617b7b68913d0cc0c1211

Linux

affected

Version	Status	Constraints
`4.3`	affected	—
`0`	unaffected	< 4.3
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc4`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[89cebc8477290b152618ffa110bbeae340d50900,d50b1fd066d66ceb548ba43e332cfe8a47e5e55a)`	affected	code_commit	—
`[89cebc8477290b152618ffa110bbeae340d50900,d98f22d2e11e0a36493aeb25b2933571ee90d9a4)`	affected	code_commit	—
`[89cebc8477290b152618ffa110bbeae340d50900,cccbabeb9a18fcb978d76d6047f2b59214aa7749)`	affected	code_commit	—
`[89cebc8477290b152618ffa110bbeae340d50900,2094dab19d45c487285617b7b68913d0cc0c1211)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.3`	affected	semver	—
`[0,4.3)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel version that contains the fixed XFS log recovery code.
If an upgrade is temporarily infeasible, mount the XFS filesystem in read‑only mode or with a read‑only journal to prevent log replay.
Verify that the filesystem image or journal file is integrity‑protected, for example with dm‑verity or disk encryption, so that an attacker cannot inject malicious logs.

Generated by OpenCVE AI on July 30, 2026 at 19:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6393-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00161.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211
https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4
https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035
https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749
https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96
https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a
https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4
https://lore.kernel.org/linux-cve-announce/2026072049-CVE-2026-64187-5cb5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64187
https://www.cve.org/CVERecord?id=CVE-2026-64187

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4 https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035 https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96

Tue, 21 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026072049-CVE-2026-64187-5cb5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64187 https://www.cve.org/CVERecord?id=CVE-2026-64187
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Mon, 20 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and ri_buf == NULL. The header can be split across op records, so later ops may still add regions; the item is only invalid if the transaction commits with none. The runtime commit path never emits such a transaction, so this only happens on a crafted log. It came from an AI-assisted code audit of the recovery parser. xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads (unsigned short )item->ri_buf[0].iov_base and faults on the NULL ri_buf. Reject it there, before the commit handlers that also read ri_buf[0]. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:618) xfs_mountfs (fs/xfs/xfs_mount.c:1034) xfs_fs_fill_super (fs/xfs/xfs_super.c:1938) vfs_get_tree (fs/super.c:1695) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367)
Title		xfs: fail recovery on a committed log item with no regions
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211 https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749 https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-20T16:27:46.653Z

Updated: 2026-07-24T14:34:17.271Z

Reserved: 2026-07-19T07:54:57.040Z

Link: CVE-2026-64187

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-07-20T00:00:00Z

Links: CVE-2026-64187 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T19:15:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object