CVE-2026-23249: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23249 is a NULL pointer dereference vulnerability (CWE-476) in the Linux kernel's XFS filesystem repair subsystem. It affects the xrep_revalidate_allocbt and xrep_revalidate_iallocbt functions, which rebuild and revalidate free space and inode B-trees simultaneously. The flaw was discovered via syzbot fuzzing by Jiaming Zhang and disclosed on March 18, 2026. Affected kernel versions include 6.8–6.12.74, 6.13–6.18.15, and 6.19–6.19.5. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the XFS B-tree revalidation logic. During xrep_revalidate_allocbt(), xchk_allocbt() is called twice — first for BNOBT, then for CNTBT. In the first call, if xfs_alloc_get_rec() returns -EFSCORRUPTED (e.g., triggered via XFS_IOC_ERROR_INJECTION), the cross-reference check in xchk_allocbt_xref_other() nullifies sc->sa.cnt_cur. When the second xchk_allocbt() call then attempts to use this now-null cursor via xchk_btree(), a kernel crash occurs. The vulnerability is reachable through the XFS_IOC_SCRUBV_METADATA ioctl call chain: xfs_file_ioctl() → xfs_ioc_scrubv_metadata() → xfs_scrub_metadata() → sc->ops->repair_eval(sc) → xrep_revalidate_allocbt(). The same flaw exists in xrep_revalidate_iallocbt (Red Hat Bugzilla).

Successful exploitation causes a kernel crash, resulting in a denial of service (DoS) on the affected system. An authenticated local attacker with low privileges can trigger system instability and interrupt filesystem operations during XFS repair procedures. There is no impact on confidentiality or integrity — only availability is affected, and the scope is limited to the local system (Red Hat Advisory).

1. Gain local access: Obtain a low-privileged local account on a Linux system running a vulnerable kernel version (6.8–6.12.74, 6.13–6.18.15, or 6.19–6.19.5) with an XFS filesystem mounted.
2. Inject filesystem error: Use the XFS_IOC_ERROR_INJECTION ioctl to inject an error condition that causes xfs_btree_check_block() to return -EFSCORRUPTED on the CNTBT cursor during a cross-reference check.
3. Trigger scrub/repair: Invoke the XFS_IOC_SCRUBV_METADATA ioctl targeting the BNOBT scrub type, which enters xrep_revalidate_allocbt() and calls xchk_allocbt() for BNOBT first.
4. Trigger cursor nullification: The first xchk_allocbt() call fails during cross-reference, causing xchk_should_check_xref() to nullify sc->sa.cnt_cur.
5. Crash the kernel: The second xchk_allocbt() call for CNTBT dereferences the now-null cursor in xchk_btree(), triggering a NULL pointer dereference and kernel panic (Red Hat Bugzilla).

• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg referencing a NULL pointer dereference in xchk_btree, xrep_revalidate_allocbt, or xrep_revalidate_iallocbt.
• Logs: Kernel messages indicating XFS filesystem corruption detection or repair attempts (XFS_IS_CORRUPT, -EFSCORRUPTED) on a specific block device.
• Process: Unusual invocations of XFS ioctl operations (XFS_IOC_SCRUBV_METADATA, XFS_IOC_ERROR_INJECTION) from non-administrative user processes.
• System: Unexpected system reboots or kernel crashes on systems with XFS filesystems, particularly during or after filesystem repair operations.

Apply the upstream kernel patches available in the stable tree for the affected version ranges: kernel 6.12.75+, 6.18.16+, and 6.19.6+ contain the fix (git.kernel.org). The fix adds null cursor checks before the second B-tree revalidation and marks the repair as incomplete if the first tree is already corrupt, applied to both xrep_revalidate_allocbt and xrep_revalidate_iallocbt. As interim mitigations: restrict access to XFS ioctl operations (XFS_IOC_SCRUBV_METADATA, XFS_IOC_ERROR_INJECTION) to trusted administrators only, and disable XFS error injection capabilities in production environments. Amazon Linux 2023 patches are available via ALAS2023-2026-1543 and ALAS2023-2026-1702 (Amazon Linux).