CVE-2026-23223

A use-after-free flaw was found in the Linux kernel's XFS filesystem scrub functionality. In xchk_btree_check_block_owner(), the code dereferences bs->cur to check if it aliases with bs->sc->sa.bno_cur or bs->sc->sa.rmap_cur after these cursors may have already been freed. This incorrect temporal ordering was introduced when the xfs_btnum_t type was removed, potentially leading to a use-after-free condition during filesystem consistency checks.

This flaw occurs in the XFS online filesystem scrub code path, which is typically invoked via the xfs_scrub utility with elevated privileges. The race window is narrow and requires specific scrub operations on XFS filesystems. Systems not using XFS or not running filesystem scrub operations are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.