{"id":"CVE-2026-64187","title":"xfs: fail recovery on a committed log item with no regions","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fail recovery on a committed log item with no regions\n\nIf the first op of a transaction is a bare transaction header\n(len == sizeof(struct xfs_trans_header)), xlog…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 5105426424ad6981db827cc1ada835a488fab035","Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4","Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d0ae7ec3aa61db5140b107f0a63e017f63e56a96","Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d50b1fd066d66ceb548ba43e332cfe8a47e5e55a","Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d98f22d2e11e0a36493aeb25b2933571ee90d9a4","Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < cccbabeb9a18fcb978d76d6047f2b59214aa7749","Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 2094dab19d45c487285617b7b68913d0cc0c1211","Linux 4.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:31:54.393338Z"},"published":"2026-07-20","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:29.301Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64187","references":[{"url":"https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035"},{"url":"https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4"},{"url":"https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96"},{"url":"https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a"},{"url":"https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4"},{"url":"https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749"},{"url":"https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211"}],"tags":["cve.org"],"epss":0.00114,"epssPercentile":0.015,"ingestedAt":"2026-11-06T16:57:43.222Z","slug":"CVE-2026-64187","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fail recovery on a committed log item with no regions\n\nIf the first op of a transaction is a bare transaction header\n(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()\nadds an item but no region, leaving it on r_itemq with ri_cnt == 0 and\nri_buf == NULL.\n\nThe header can be split across op records, so later ops may still add\nregions; the item is only invalid if the transaction commits with none.\nThe runtime commit path never emits such a transaction, so this only\nhappens on a crafted log.  It came from an AI-assisted code audit of the\nrecovery parser.\n\nxlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads\n*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL\nri_buf.  Reject it there, before the commit handlers that also read\nri_buf[0].\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)\n  xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)\n  xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)\n  xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)\n  xlog_recover (fs/xfs/xfs_log_recover.c:3493)\n  xfs_log_mount (fs/xfs/xfs_log.c:618)\n  xfs_mountfs (fs/xfs/xfs_mount.c:1034)\n  xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)\n  vfs_get_tree (fs/super.c:1695)\n  path_mount (fs/namespace.c:4161)\n  __x64_sys_mount (fs/namespace.c:4367)\n\n## Affected\n\n- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 5105426424ad6981db827cc1ada835a488fab035`\n- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4`\n- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d0ae7ec3aa61db5140b107f0a63e017f63e56a96`\n- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d50b1fd066d66ceb548ba43e332cfe8a47e5e55a`\n- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d98f22d2e11e0a36493aeb25b2933571ee90d9a4`\n- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < cccbabeb9a18fcb978d76d6047f2b59214aa7749`\n- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 2094dab19d45c487285617b7b68913d0cc0c1211`\n- `Linux 4.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}