CVE-2026-23251 — NULL Pointer Dereference in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.0%
top 93.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 18
Description
In the Linux kernel, the following vulnerability has been resolved:
xfs: only call xf{array,blob}_destroy if we have a valid pointer
Only call the xfarray and xfblob destructor if we have a valid pointer,
and be sure to null out that pointer afterwards. Note that this patch
fixes a large number of commits, most of which were merged between 6.9
and 6.10.
Affected Packages3 packages
▶CVEListV5linux/linuxab97f4b1c030750f2475bf4da8a9554d02206640 — 5de5be3ed7e7fa4ebde4f4b58fb9a629644f9202+4
🔴Vulnerability Details
4OSV▶
CVE-2026-23251: In the Linux kernel, the following vulnerability has been resolved: xfs: only call xf{array,blob}_destroy if we have a valid pointer Only call the xfa↗2026-03-18
GHSA▶
GHSA-h6jp-94m7-xf6p: In the Linux kernel, the following vulnerability has been resolved:
xfs: only call xf{array,blob}_destroy if we have a valid pointer
Only call the x↗2026-03-18