GHSA-5FJH-93MH-6XVW
Vulnerability from github – Published: 2026-07-20 18:32 – Updated: 2026-07-20 18:32In the Linux kernel, the following vulnerability has been resolved:
xfs: fail recovery on a committed log item with no regions
If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and ri_buf == NULL.
The header can be split across op records, so later ops may still add regions; the item is only invalid if the transaction commits with none. The runtime commit path never emits such a transaction, so this only happens on a crafted log. It came from an AI-assisted code audit of the recovery parser.
xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads (unsigned short )item->ri_buf[0].iov_base and faults on the NULL ri_buf. Reject it there, before the commit handlers that also read ri_buf[0].
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:618) xfs_mountfs (fs/xfs/xfs_mount.c:1034) xfs_fs_fill_super (fs/xfs/xfs_super.c:1938) vfs_get_tree (fs/super.c:1695) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367)
{
"affected": [],
"aliases": [
"CVE-2026-64187"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T17:18:21Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fail recovery on a committed log item with no regions\n\nIf the first op of a transaction is a bare transaction header\n(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()\nadds an item but no region, leaving it on r_itemq with ri_cnt == 0 and\nri_buf == NULL.\n\nThe header can be split across op records, so later ops may still add\nregions; the item is only invalid if the transaction commits with none.\nThe runtime commit path never emits such a transaction, so this only\nhappens on a crafted log. It came from an AI-assisted code audit of the\nrecovery parser.\n\nxlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads\n*(unsigned short *)item-\u003eri_buf[0].iov_base and faults on the NULL\nri_buf. Reject it there, before the commit handlers that also read\nri_buf[0].\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)\n xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)\n xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)\n xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)\n xlog_recover (fs/xfs/xfs_log_recover.c:3493)\n xfs_log_mount (fs/xfs/xfs_log.c:618)\n xfs_mountfs (fs/xfs/xfs_mount.c:1034)\n xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)\n vfs_get_tree (fs/super.c:1695)\n path_mount (fs/namespace.c:4161)\n __x64_sys_mount (fs/namespace.c:4367)",
"id": "GHSA-5fjh-93mh-6xvw",
"modified": "2026-07-20T18:32:33Z",
"published": "2026-07-20T18:32:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64187"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.