{"id":"CVE-2026-23223","title":"xfs: fix UAF in xchk_btree_check_block_owner","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix UAF in xchk_btree_check_block_owner\n\nWe cannot dereference bs->cur when trying to determine if bs->cur\naliases bs->sc->sa.{bno,rmap}_cur after the latter has b…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < 1d411278dda293a507cb794db7d9ed3511c685c6","Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < ed82e7949f5cac3058f4100f3cd670531d41a266","Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < ba5264610423d9653aa36920520902d83841bcfd","Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < 1c253e11225bc5167217897885b85093e17c2217","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:22:45.786541Z"},"published":"2026-02-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:23:22.930Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23223","references":[{"url":"https://git.kernel.org/stable/c/1d411278dda293a507cb794db7d9ed3511c685c6"},{"url":"https://git.kernel.org/stable/c/ed82e7949f5cac3058f4100f3cd670531d41a266"},{"url":"https://git.kernel.org/stable/c/ba5264610423d9653aa36920520902d83841bcfd"},{"url":"https://git.kernel.org/stable/c/1c253e11225bc5167217897885b85093e17c2217"}],"tags":["cve.org"],"epss":0.0014,"epssPercentile":0.0335,"ingestedAt":"2026-11-05T22:38:32.090Z","slug":"CVE-2026-23223","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix UAF in xchk_btree_check_block_owner\n\nWe cannot dereference bs->cur when trying to determine if bs->cur\naliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed.\nFix this by sampling before type before any freeing could happen.\nThe correct temporal ordering was broken when we removed xfs_btnum_t.\n\n## Affected\n\n- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < 1d411278dda293a507cb794db7d9ed3511c685c6`\n- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < ed82e7949f5cac3058f4100f3cd670531d41a266`\n- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < ba5264610423d9653aa36920520902d83841bcfd`\n- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < 1c253e11225bc5167217897885b85093e17c2217`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}