---
id: CVE-2026-64187
title: 'xfs: fail recovery on a committed log item with no regions'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: fail recovery on a committed log item with no regions

  If the first op of a transaction is a bare transaction header
  (len == sizeof(struct xfs_trans_header)), xlog…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 89cebc8477290b152618ffa110bbeae340d50900 <
    5105426424ad6981db827cc1ada835a488fab035
  - >-
    Linux >= 89cebc8477290b152618ffa110bbeae340d50900 <
    226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4
  - >-
    Linux >= 89cebc8477290b152618ffa110bbeae340d50900 <
    d0ae7ec3aa61db5140b107f0a63e017f63e56a96
  - >-
    Linux >= 89cebc8477290b152618ffa110bbeae340d50900 <
    d50b1fd066d66ceb548ba43e332cfe8a47e5e55a
  - >-
    Linux >= 89cebc8477290b152618ffa110bbeae340d50900 <
    d98f22d2e11e0a36493aeb25b2933571ee90d9a4
  - >-
    Linux >= 89cebc8477290b152618ffa110bbeae340d50900 <
    cccbabeb9a18fcb978d76d6047f2b59214aa7749
  - >-
    Linux >= 89cebc8477290b152618ffa110bbeae340d50900 <
    2094dab19d45c487285617b7b68913d0cc0c1211
  - Linux 4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:31:54.393338Z'
published: '2026-07-20'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:29.301Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64187'
references:
  - url: 'https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035'
  - url: 'https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4'
  - url: 'https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96'
  - url: 'https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a'
  - url: 'https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4'
  - url: 'https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749'
  - url: 'https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.015
ingestedAt: '2026-11-06T16:57:43.222Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: fail recovery on a committed log item with no regions

If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.

The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log.  It came from an AI-assisted code audit of the
recovery parser.

xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf.  Reject it there, before the commit handlers that also read
ri_buf[0].

 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
  xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
  xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
  xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
  xlog_recover (fs/xfs/xfs_log_recover.c:3493)
  xfs_log_mount (fs/xfs/xfs_log.c:618)
  xfs_mountfs (fs/xfs/xfs_mount.c:1034)
  xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
  vfs_get_tree (fs/super.c:1695)
  path_mount (fs/namespace.c:4161)
  __x64_sys_mount (fs/namespace.c:4367)

## Affected

- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 5105426424ad6981db827cc1ada835a488fab035`
- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4`
- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d0ae7ec3aa61db5140b107f0a63e017f63e56a96`
- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d50b1fd066d66ceb548ba43e332cfe8a47e5e55a`
- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < d98f22d2e11e0a36493aeb25b2933571ee90d9a4`
- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < cccbabeb9a18fcb978d76d6047f2b59214aa7749`
- `Linux >= 89cebc8477290b152618ffa110bbeae340d50900 < 2094dab19d45c487285617b7b68913d0cc0c1211`
- `Linux 4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.