CVE-2026-74728: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74728 is a NULL pointer dereference vulnerability in the Linux kernel's XFS filesystem subsystem, specifically in the xfs_buf_free() function. When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still set to NULL, causing the code to fall through to the folio_put path which invokes virt_to_folio(NULL), dereferencing an invalid address and triggering a kernel crash. The vulnerability affects Linux kernel versions starting from 6.9 up to (but not including) the fixed releases. Fixed versions include 6.18.45 (for the 6.18.x branch), 7.1.9 (for the 7.1.x branch), and 7.2 and later. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in fs/xfs/xfs_buf.c. When memory allocation via xfs_buf_alloc_backing_mem() fails during XFS buffer initialization, the cleanup path in xfs_buf_free() does not check whether bp->b_addr is NULL before proceeding to call virt_to_folio(), which dereferences the NULL pointer and causes a kernel panic. The vulnerable code path is triggered during XFS repair operations (e.g., xrep_rmapbt → xrep_rmap_setup_scan → xfbtree_init → xfbtree_init_leaf_block → xfs_buf_get_map → xfs_buf_find_insert → xfs_buf_alloc → xfs_buf_free). The fix adds a NULL check for bp->b_addr before calling folio_put() (GitHub Advisory, Kernel Patch 1).

Successful exploitation causes a kernel panic (system crash), resulting in a complete denial of service for the affected host. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Because the crash occurs in kernel space, it affects all processes running on the system, not just XFS-related operations. The vulnerability requires local access to trigger XFS filesystem repair operations under memory pressure conditions (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access to a system running an affected Linux kernel version (6.9 through pre-fix releases) with an XFS filesystem, and the ability to trigger memory allocation failures during XFS repair operations. The EPSS score is 0.0, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output referencing xfs_buf_free, xfs_buf_alloc, xfbtree_init, or xrep_rmapbt in the call trace.
• System Behavior: Unexpected system reboots or kernel oops/panic events on hosts using XFS filesystems, particularly during filesystem repair or maintenance operations.
• Process: Unusual invocations of XFS repair utilities (e.g., xfs_repair) under low-memory conditions that result in system crashes.

Update the Linux kernel to a patched version: 6.18.45 or later for the 6.18.x stable branch, 7.1.9 or later for the 7.1.x stable branch, or kernel 7.2 and above. The fix is implemented in commits ccf6738adcafa5ddbddc4e71b45d8a51b86643c7, 3aa0c1d23ee1b9d9b340fb2f4736536e1408d706, and d852729c5f4f830fbe7413df032e29459b3daf83. As a workaround, restrict access to XFS repair utilities and filesystem operations to trusted administrative users, and avoid running XFS repair operations under low-memory conditions until the patch is applied (Feedly, Kernel Patch 1).