CVE-2026-74728 Linux CVE debrief

Who should care

Linux system administrators and users, as well as developers working with the Linux kernel, should assess their exposure to this vulnerability and apply patches or updates as necessary.

Why it matters

Linux kernel vulnerability CVE-2026-74728 allows a NULL pointer dereference in xfs_buf_free, potentially causing kernel crashes. Linux system administrators and users should assess exposure and apply patches.

• Potential kernel crashes due to NULL pointer dereference.
• Need to verify Linux kernel versions and apply patches or updates.
• Possible impact on system stability and reliability.

Technical summary

The vulnerability occurs in the xfs_buf_free function of the Linux kernel. When xfs_buf_alloc_backing_mem fails, it leaves bp->b_addr as NULL. The code then attempts to call folio_put, which leads to a call to virt_to_folio with a NULL address, resulting in a kernel crash. The issue is resolved by skipping folio_put when bp->b_addr is NULL. This fix prevents the NULL pointer dereference and potential kernel crashes. Linux kernel versions should be verified for exposure, and patches or updates should be applied to address the vulnerability.

Defensive priority

Apply patches or updates from Linux to address the vulnerability.

Recommended defensive actions

• Assess exposure by reviewing system configurations and inventory Linux kernel versions.
• Apply patches or updates from Linux to address the vulnerability.
• Monitor system logs for potential kernel crashes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. The vulnerability occurs in the xfs_buf_free function of the Linux kernel. When xfs_buf_alloc_backing_mem fails, it leaves bp->b_addr as NULL. The code then attempts to call folio_put, which leads to a call to virt_to_folio with a NULL address, resulting in a kernel crash. The issue is resolved by skipping folio_put when bp->b_addr is NULL. Linux system The CVE x

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.