CVE-2026-74728

In the Linux kernel, the following vulnerability has been resolved:

xfs: handle NULL b_addr in xfs_buf_free

When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with

bp->b_addr still NULL. The code falls through to the folio_put path

which calls virt_to_folio(NULL), dereferencing an invalid address and

causing a kernel crash.

Call Trace:

xfs_buf_free+0x25f/0x510

xfs_buf_alloc+0xc98/0x19b0

xfs_buf_find_insert+0x55/0x14d0

xfs_buf_get_map+0x122b/0x17c0

xfbtree_init_leaf_block+0x11c/0x4a0

xfbtree_init+0x1bb/0x460

xrep_rmap_setup_scan+0x100/0x1f0

xrep_rmapbt+0x41/0xc0

Fix this by skipping folio_put() when bp->b_addr is NULL.