The Linux kernel XFS filesystem recovery code had a flaw where a committed log item with no regions could cause a null pointer dereference during recovery. Specifically, if the first operation of a transaction is a bare transaction header (with length equal to the size of the transaction header struct), the recovery function xlog_recover_add_to_trans() adds an item without any region, leaving it on the recovery item queue with a null buffer pointer. Later, the function xlog_recover_reorder_trans() attempts to read from this null buffer, causing a fault. This vulnerability only occurs with crafted log data, as the normal commit path never produces such transactions. The issue was discovered via an AI-assisted code audit and fixed by rejecting such invalid items early in the recovery process.

The vulnerability can cause a null pointer dereference in the kernel during XFS log recovery, potentially leading to a denial of service (system crash) when mounting or recovering the filesystem with a maliciously crafted log. There is no indication of code execution or privilege escalation. The fault occurs only if the filesystem log is crafted to trigger this condition, which is not possible through normal operation.

A fix for this vulnerability has been implemented in the Linux kernel source to reject committed log items with no regions during recovery, preventing the null pointer dereference. Since no explicit patch links or vendor advisory are provided, users should apply the latest Linux kernel updates that include this fix. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or trusted sources for the current remediation status.