CVE-2026-74728: xfs: handle NULL b_addr in xfs_buf_free
In the Linux kernel, the following vulnerability has been resolved:
xfs: handle NULL baddr in xfsbuffree
When xfsbufallocbackingmem() fails, xfsbuffree() is called with bp->baddr still NULL. The code falls through to the folioput path which calls virttofolio(NULL), dereferencing an invalid address and causing a kernel crash.
Call Trace: xfsbuffree+0x25f/0x510 xfsbufalloc+0xc98/0x19b0 xfsbuffindinsert+0x55/0x14d0 xfsbufgetmap+0x122b/0x17c0 xfbtreeinitleafblock+0x11c/0x4a0 xfbtreeinit+0x1bb/0x460 xreprmapsetupscan+0x100/0x1f0 xreprmapbt+0x41/0xc0
Fix this by skipping folioput() when bp->baddr is NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix so that xfs_buf_free() checks bp->b_addr for NULL and skips the folio_put() path when bp->b_addr is NULL (to avoid virt_to_folio(NULL) dereference and kernel crash).
Linux kernel (XFS) xfs_buf_free() NULL handling = Skip folio_put() when bp->b_addr is NULL
Event History
Frequently Asked Questions
What condition triggers the crash?
The crash occurs when xfs_buf_alloc_backing_mem() fails and xfs_buf_free() is subsequently called while bp->b_addr is still NULL. The cleanup path calls folio_put(), which reaches virt_to_folio(NULL) and dereferences an invalid address.
What kernel activity is shown in the failing call trace?
The supplied trace shows the failure during XFS repair-related rmap processing, through xrep_rmapbt(), xrep_rmap_setup_scan(), and xfbtree initialization. The data does not establish whether other XFS paths can also reach the same allocation-failure cleanup path.
What does the fix change?
The fix prevents xfs_buf_free() from calling folio_put() when bp->b_addr is NULL. This avoids converting a NULL buffer address to a folio during cleanup after backing-memory allocation fails.