CVE-2026-23250

A NULL pointer dereference vulnerability was found in the Linux kernel's XFS filesystem scrub code. The xchk_scrub_create_subord() function returns a mangled ENOMEM error code instead of NULL on memory allocation failure. Callers do not properly check for null pointers before using the returned value, leading to NULL pointer dereferences when memory allocation fails during scrub operations.

This flaw affects XFS filesystems using the online scrub functionality (xfs_scrub). The issue exists in code merged between kernel versions 6.2 and 6.10. Triggering this vulnerability requires invoking XFS scrub operations while the system is under memory pressure, causing allocation failures. The scrub functionality requires privileged access to execute.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.