Linux Kernel up to 6.18.15/6.19.5 xfs allocation of resources

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.15/6.19.5. It has been classified as critical. Affected is an unknown function of the component xfs. This manipulation causes allocation of resources. The identification of this vulnerability is CVE-2026-23252. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 6.18.15/6.19.5. Affected by this vulnerability is an unknown code block of the component xfs. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: xfs: get rid of the xchk_xfile_*_descr calls The xchk_xfile_*_descr macros call kasprintf, which can fail to allocate memory if the formatted string is larger than 16 bytes (or whatever the nofail guarantees are nowadays). Some of them could easily exceed that, and Jiaming Zhang found a few places where that can happen with syzbot. The descriptions are debugging aids and aren't required to be unique, so let's just pass in static strings and eliminate this path to failure. Note this patch touches a number of commits, most of which were merged between 6.6 and 6.14.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2026-23252 since 01/13/2026. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.18.16, 6.19.6 or 7.0-rc1 eliminates this vulnerability. Applying the patch 18e9cf2259b4157fd282b323514375f2f6a59edb/2d8afee89262762fe0e5547772708c75f320c957/60382993a2e18041f88c7969f567f168cd3b4de3 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0790). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion