CVE-2018-10322: Null Pointer Dereference
Last updated 14 August 2026
Other sources
The xfsdinodeverify function in fs/xfs/libxfs/xfsinodebuf.c in the Linux kernel can cause a NULL pointer dereference in xfsilockattrmapshared function. An attacker could trick a legitimate user or a privileged attacker could exploit this by mounting a crafted xfs filesystem image to cause a kernel panic and thus a denial of service.
References:
https://www.spinics.net/lists/linux-xfs/msg17215.html
https://bugzilla.kernel.org/showbug.cgi?id=199377
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b42db0860e130
— Red Hat
The xfsdinodeverify function in fs/xfs/libxfs/xfsinodebuf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfsilockattrmapshared invalid pointer dereference) via a crafted xfs image.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
linux kernel xfsto a version that resolves this vulnerability.Fixed in 4.16.3 - Upgrade
Upgrade
linux kernel xfsto a version that resolves this vulnerability.Patch b42db0860e130
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10322?
CVE-2018-10322 has a severity rating of high due to the potential for NULL pointer dereference leading to denial of service.
How do I fix CVE-2018-10322?
To fix CVE-2018-10322, you should upgrade to the patched versions of the Linux kernel or the appropriate Red Hat virtualization host software.
Which versions are affected by CVE-2018-10322?
CVE-2018-10322 affects multiple versions of the Linux kernel up to 4.16.3 and specific Red Hat products running version 7.0.
What impact does CVE-2018-10322 have on systems?
Exploitation of CVE-2018-10322 could allow an attacker to crash the system, resulting in a denial of service.
Is CVE-2018-10322 exploitable remotely?
CVE-2018-10322 can be exploited locally if an attacker can mount a crafted XFS filesystem.