CVE-2026-74728: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74728 Overview

CVE-2026-74728 is a NULL pointer dereference vulnerability in the Linux kernel's XFS filesystem code. The flaw resides in the xfs_buf_free() function, which fails to check whether bp->b_addr is NULL before falling through to the folio_put path. When xfs_buf_alloc_backing_mem() fails to allocate backing memory, xfs_buf_free() is invoked with bp->b_addr still NULL. The subsequent call to virt_to_folio(NULL) dereferences an invalid address, producing a kernel crash.

Critical Impact
A failed buffer memory allocation in XFS triggers a kernel NULL pointer dereference, resulting in denial of service through a system crash.

Affected Products

Linux kernel with XFS filesystem support (stable branches referenced by upstream patches)
Systems using XFS online repair (xrep_rmapbt) and xfbtree code paths
Distributions shipping kernels prior to the referenced stable patches

Discovery Timeline

2026-08-22 - CVE-2026-74728 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74728

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in the XFS buffer management subsystem. XFS uses xfs_buf_t structures to represent in-memory filesystem buffers. When a new buffer is created through xfs_buf_alloc(), the code calls xfs_buf_alloc_backing_mem() to allocate the folio-backed memory referenced by bp->b_addr.

If that allocation fails, the error path invokes xfs_buf_free() to release the partially constructed buffer. The cleanup logic in xfs_buf_free() falls through to a folio_put() branch that calls virt_to_folio(bp->b_addr). Because b_addr is still NULL at that point, virt_to_folio(NULL) dereferences an invalid kernel address and triggers a crash.

The reported call trace originates from XFS online repair code (xrep_rmap_setup_scan, xfbtree_init, xfbtree_init_leaf_block), which exercises buffer allocation paths that are especially sensitive to memory pressure.

Root Cause

The root cause is missing NULL validation on bp->b_addr in the buffer free path. The cleanup routine assumes a successful allocation always populated the backing address before entering the free logic. Under allocation failure, that assumption is violated. The fix skips folio_put() when bp->b_addr is NULL, avoiding the invalid dereference.

Attack Vector

Exploitation requires triggering an allocation failure inside xfs_buf_alloc_backing_mem(). This most commonly occurs under memory pressure or during heavy filesystem repair activity. A local user or workload that induces sustained memory pressure while operating on an XFS filesystem, especially one undergoing online repair, can trigger the crash and cause a denial of service.

The vulnerability is a reliability and availability defect. There is no evidence of memory corruption, privilege escalation, or code execution primitives.

See the upstream fixes for implementation details: Kernel Patch 3aa0c1d, Kernel Patch ccf6738a, and Kernel Patch d852729c.

Detection Methods for CVE-2026-74728

Indicators of Compromise

Kernel oops or panic logs containing xfs_buf_free+0x25f/0x510 in the call trace
Crash traces referencing xfs_buf_alloc, xfs_buf_find_insert, or xfs_buf_get_map followed by NULL pointer dereference messages
Repeated failures within xrep_rmap_setup_scan or xfbtree_init paths during XFS online repair operations

Detection Strategies

Parse dmesg, journalctl -k, and /var/log/kern.log for BUG: kernel NULL pointer dereference messages tied to XFS buffer functions
Correlate kernel crash telemetry with memory pressure events such as OOM kills and high MemAvailable drops
Track unexpected reboots or node evictions on servers running XFS with online repair enabled

Monitoring Recommendations

Enable kdump on XFS hosts to capture crash dumps for post-incident triage
Monitor kernel version inventory to identify hosts running unpatched XFS code paths
Alert on repeated xfs_buf_alloc allocation failures visible through XFS tracepoints and perf events

How to Mitigate CVE-2026-74728

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD entry to all systems running XFS filesystems
Prioritize patching hosts that regularly run xfs_repair or online repair (xrep_rmapbt) workloads
Verify that vendor-supplied kernel updates include the xfs_buf_free NULL check fix before rolling out

Patch Information

The fix updates xfs_buf_free() to skip folio_put() when bp->b_addr is NULL. The change is available in the following upstream commits: Kernel Patch 3aa0c1d, Kernel Patch ccf6738a, and Kernel Patch d852729c. Consult your Linux distribution's security tracker for the specific backported package version.

Workarounds

Avoid running XFS online repair operations on hosts experiencing memory pressure until patches are applied
Increase available memory or tune vm.min_free_kbytes to reduce the likelihood of xfs_buf_alloc_backing_mem() failures
Restrict local users' ability to trigger heavy XFS metadata operations on shared multi-tenant systems

bash

# Verify running kernel version and check for the XFS buffer fix
uname -r
grep -E 'xfs_buf_free|virt_to_folio' /proc/kallsyms | head

# Reduce risk of allocation failure by reserving more free memory
sysctl -w vm.min_free_kbytes=131072

# Enable kdump to capture future crash traces
systemctl enable --now kdump