CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved:

xfs: fail recovery on a committed log item with no regions

If the first op of a transaction is a bare transaction header

(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()

adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and

ri_buf == NULL.

The header can be split across op records, so later ops may still add

regions; the item is only invalid if the transaction commits with none.

The runtime commit path never emits such a transaction, so this only

happens on a crafted log. It came from an AI-assisted code audit of the

recovery parser.

xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads

*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL

ri_buf. Reject it there, before the commit handlers that also read

ri_buf[0].

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)

xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)

xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)

xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)

xlog_recover (fs/xfs/xfs_log_recover.c:3493)

xfs_log_mount (fs/xfs/xfs_log.c:618)

xfs_mountfs (fs/xfs/xfs_mount.c:1034)

xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)

vfs_get_tree (fs/super.c:1695)

path_mount (fs/namespace.c:4161)

__x64_sys_mount (fs/namespace.c:4367)