Linux Kernel Vulnerability in XFS Buffer Management

CVE-2026-74728

What is CVE-2026-74728?

A vulnerability in the Linux kernel occurs when the XFS file system's buffer management code fails to properly handle null pointers in the xfs_buf_free function. Specifically, if the xfs_buf_alloc_backing_mem() operation fails, it can lead to a dereference of a null address within the folio_put path, ultimately causing a kernel crash. The issue arises when the bp->b_addr is still null, which leads to invalid memory access. This vulnerability is resolved by ensuring that folio_put is skipped when bp->b_addr is null, thus enhancing the stability and security of the kernel.

References