CVE-2026-64187: xfs: fail recovery on a committed log item with no regions

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

xfs: fail recovery on a committed log item with no regions

If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.

The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log.  It came from an AI-assisted code audit of the
recovery parser.

xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf.  Reject it there, before the commit handlers that also read
ri_buf[0].

 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
  xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
  xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
  xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
  xlog_recover (fs/xfs/xfs_log_recover.c:3493)
  xfs_log_mount (fs/xfs/xfs_log.c:618)
  xfs_mountfs (fs/xfs/xfs_mount.c:1034)
  xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
  vfs_get_tree (fs/super.c:1695)
  path_mount (fs/namespace.c:4161)
  __x64_sys_mount (fs/namespace.c:4367)

The Linux kernel CVE team has assigned CVE-2026-64187 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.3 with commit 89cebc8477290b152618ffa110bbeae340d50900 and fixed in 6.12.96 with commit d50b1fd066d66ceb548ba43e332cfe8a47e5e55a
	Issue introduced in 4.3 with commit 89cebc8477290b152618ffa110bbeae340d50900 and fixed in 6.18.39 with commit d98f22d2e11e0a36493aeb25b2933571ee90d9a4
	Issue introduced in 4.3 with commit 89cebc8477290b152618ffa110bbeae340d50900 and fixed in 7.1.4 with commit cccbabeb9a18fcb978d76d6047f2b59214aa7749
	Issue introduced in 4.3 with commit 89cebc8477290b152618ffa110bbeae340d50900 and fixed in 7.2-rc4 with commit 2094dab19d45c487285617b7b68913d0cc0c1211

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64187
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/xfs/xfs_log_recover.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a
	https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4
	https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749
	https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211