CVE-2026-64187
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
xfs: fail recovery on a committed log item with no regions
If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and ri_buf == NULL.
The header can be split across op records, so later ops may still add regions; the item is only invalid if the transaction commits with none. The runtime commit path never emits such a transaction, so this only happens on a crafted log. It came from an AI-assisted code audit of the recovery parser.
Leer descripción completaMostrar menos
xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads *(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL ri_buf. Reject it there, before the commit handlers that also read ri_buf[0].
Detalles técnicos trazas, registros y código del informe original
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:618) xfs_mountfs (fs/xfs/xfs_mount.c:1034) xfs_fs_fill_super (fs/xfs/xfs_super.c:1938) vfs_get_tree (fs/super.c:1695) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367)
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.11%
- Percentil entre todas las CVEs puntuadas: 1
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
- https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211
- https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4
- https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035
- https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749
- https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96
- https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a
- https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-64187",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"lessThan": "5105426424ad6981db827cc1ada835a488fab035",
"versionType": "git"
},
{
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"lessThan": "226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4",
"versionType": "git"
},
{
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"lessThan": "d0ae7ec3aa61db5140b107f0a63e017f63e56a96",
"versionType": "git"
},
{
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"lessThan": "d50b1fd066d66ceb548ba43e332cfe8a47e5e55a",
"versionType": "git"
},
{
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"lessThan": "d98f22d2e11e0a36493aeb25b2933571ee90d9a4",
"versionType": "git"
},
{
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"lessThan": "cccbabeb9a18fcb978d76d6047f2b59214aa7749",
"versionType": "git"
},
{
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"lessThan": "2094dab19d45c487285617b7b68913d0cc0c1211",
"versionType": "git"
}
],
"programFiles": [
"fs/xfs/xfs_log_recover.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/xfs/xfs_log_recover.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-07-20T17:18:21.743",
"references": [
{
"url": "https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fail recovery on a committed log item with no regions\n\nIf the first op of a transaction is a bare transaction header\n(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()\nadds an item but no region, leaving it on r_itemq with ri_cnt == 0 and\nri_buf == NULL.\n\nThe header can be split across op records, so later ops may still add\nregions; the item is only invalid if the transaction commits with none.\nThe runtime commit path never emits such a transaction, so this only\nhappens on a crafted log. It came from an AI-assisted code audit of the\nrecovery parser.\n\nxlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads\n*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL\nri_buf. Reject it there, before the commit handlers that also read\nri_buf[0].\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)\n xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)\n xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)\n xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)\n xlog_recover (fs/xfs/xfs_log_recover.c:3493)\n xfs_log_mount (fs/xfs/xfs_log.c:618)\n xfs_mountfs (fs/xfs/xfs_mount.c:1034)\n xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)\n vfs_get_tree (fs/super.c:1695)\n path_mount (fs/namespace.c:4161)\n __x64_sys_mount (fs/namespace.c:4367)"
}
],
"lastModified": "2026-08-17T05:17:21.720",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28E97AE0-962A-4211-AEDF-295D80859CF2",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.3"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6ECA620-8606-4230-A87D-3FF3EFE12592"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}