CVE-2026-23043

A NULL pointer dereference vulnerability was found in the Linux kernel's Btrfs filesystem log replay code. When btrfs_alloc_path() fails in replay_one_buffer() due to memory allocation failure, wc->subvol_path is left NULL. Subsequently, btrfs_abort_log_replay() calls do_abort_log_replay() which unconditionally dereferences wc->subvol_path to print debug information, causing a kernel crash.

This vulnerability was identified by Coverity static analysis and occurs during Btrfs log replay when the system is under memory pressure. The crash happens in the error handling path when a path allocation fails during recovery operations. The impact is limited to denial of service during filesystem mount after an unclean shutdown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.