UBUNTU-CVE-2026-74728: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem() fails, xfsbuffree() is called with bp->baddr still NULL. The code falls through to the folioput path which calls virttofolio(NULL), dereferencing an invalid address and causing a kernel crash. Call Trace: xfsbuffree+0x25f/0x510 xfsbufalloc+0xc98/0x19b0 xfsbuffindinsert+0x55/0x14d0 xfsbufgetmap+0x122b/0x17c0 xfbtreeinitleafblock+0x11c/0x4a0 xfbtreeinit+0x1bb/0x460 xreprmapsetupscan+0x100/0x1f0 xreprmapbt+0x41/0xc0 Fix this by skipping folioput() when bp->baddr is NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify xfs_buf_free() to skip folio_put() when bp->b_addr is NULL.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What condition triggers the kernel crash?
The crash occurs when xfs_buf_alloc_backing_mem() fails and leaves bp->b_addr as NULL. xfs_buf_free() then reaches the folio_put path, which calls virt_to_folio(NULL) and dereferences an invalid address.
How can an existing occurrence be identified?
A kernel crash may show a call trace containing xfs_buf_free, xfs_buf_alloc, xfs_buf_find_insert, xfs_buf_get_map, xfbtree_init, and xrep_rmapbt. The faulting behavior is associated with virt_to_folio(NULL) during buffer cleanup.