CVE-2026-64187

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and ri_buf == NULL. The header can be split across op records, so later ops may still add regions; the item is only invalid if the transaction commits with none. The runtime commit path never emits such a transaction, so this only happens on a crafted log. It came from an AI-assisted code audit of the recovery parser. xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads *(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL ri_buf. Reject it there, before the commit handlers that also read ri_buf[0]. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:618) xfs_mountfs (fs/xfs/xfs_mount.c:1034) xfs_fs_fill_super (fs/xfs/xfs_super.c:1938) vfs_get_tree (fs/super.c:1695) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367)

Gravité et risque d'exploitation

CVE-2026-64187 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.11 %, ce qui la place devant 1.4 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions <4.3, <d98f22d2e11e0a36493aeb25b2933571ee90d9a4, <=6.1.*, <=6.12.*, 6.18.39, 0, <2094dab19d45c487285617b7b68913d0cc0c1211, <226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4, <=7.1.*, <d0ae7ec3aa61db5140b107f0a63e017f63e56a96, 7.1.4, 6.1.178, <=6.6.*, <5105426424ad6981db827cc1ada835a488fab035, <d50b1fd066d66ceb548ba43e332cfe8a47e5e55a, <=6.18.*, 5.15.212, 6.6.145, 4.3, <=*, <=5.15.*, <cccbabeb9a18fcb978d76d6047f2b59214aa7749, 6.12.96, 7.2, 89cebc8477290b152618ffa110bbeae340d50900) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035
• https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4
• https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96
• https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a
• https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4
• https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749
• https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211