CVE-2026-23250: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23250 is a NULL pointer dereference vulnerability in the Linux kernel's XFS filesystem subsystem, specifically in the xchk_scrub_create_subord function. The function incorrectly returned a mangled ENOMEM error value instead of NULL on memory allocation failure, and callers did not properly check for a null pointer return, creating a potential crash condition. It affects Linux kernel versions 6.10–6.12.74, 6.13–6.18.15, and 6.19–6.19.5; most of the affected code was merged between kernel versions 6.2 and 6.10. The vulnerability was disclosed on March 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The xchk_scrub_create_subord function in the XFS online scrub subsystem (fs/xfs/scrub/) was returning a pointer-encoded ENOMEM error (via ERR_PTR) rather than NULL when a memory allocation failed; callers expected a NULL return and did not perform the appropriate null-pointer check before dereferencing the result. This local attack vector requires low privileges and no user interaction — an attacker with local filesystem access could trigger the code path through XFS scrub operations to cause improper memory handling. The fix, applied across multiple stable branches, corrects the function to return NULL and updates all callers to check for it and propagate ENOMEM appropriately (Red Hat Bugzilla, Kernel Patch).

Successful exploitation by a local, low-privileged attacker could result in a kernel denial of service via system crash (availability impact: High). There is no direct confidentiality or integrity impact as assessed by the CVSS score, though the Feedly executive summary notes a theoretical risk of sensitive memory content exposure or data integrity violations under specific conditions. The vulnerability is confined to systems using XFS filesystems and does not provide a direct path for privilege escalation or lateral movement based on current analysis (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

Update to a patched Linux kernel version: 6.12.75 or later (for the 6.10–6.12 branch), 6.18.16 or later (for the 6.13–6.18 branch), 6.19.6 or later (for the 6.19 branch), or 7.0-rc1 and later. Patches are available in the upstream stable kernel tree. As a workaround where patching is not immediately possible, restrict local user access to XFS filesystem scrub utilities and limit the privileges of users who can interact with XFS-mounted filesystems. Debian and Oracle Linux have also issued distribution-level kernel updates addressing this vulnerability (Red Hat Bugzilla, Kernel Patch).