CVE-2026-23249

A NULL pointer dereference vulnerability was found in the Linux kernel's XFS filesystem scrub/repair code. In xrep_revalidate_allocbt(), when revalidating both the BNOBT and CNTBT btrees, if the first btree validation fails during cross-reference, the second btree cursor is nullified. The code then attempts to revalidate the second btree using the NULL cursor, causing a kernel crash.

This flaw affects XFS filesystems when using the online scrub/repair functionality (xfs_scrub). The crash can be triggered via the XFS_IOC_SCRUBV_METADATA ioctl, potentially in combination with error injection. The vulnerability is in the repair validation path and requires privileged access to invoke filesystem scrub operations. Similar issues exist in xrep_revalidate_iallocbt().

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.