---
id: CVE-2026-74728
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: handle NULL b_addr in xfs_buf_free

  When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
  bp->b_addr still NULL
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: handle NULL b_addr in xfs_buf_free

  When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
  bp->b_addr still NULL.  The code falls through to the fol…
severity: none
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74728'
references:
  - url: 'https://git.kernel.org/stable/c/3aa0c1d23ee1b9d9b340fb2f4736536e1408d706'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ccf6738adcafa5ddbddc4e71b45d8a51b86643c7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d852729c5f4f830fbe7413df032e29459b3daf83'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00206
epssPercentile: 0.09916
ingestedAt: '2026-10-14T13:30:58.549Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: handle NULL b_addr in xfs_buf_free

When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
bp->b_addr still NULL.  The code falls through to the folio_put path
which calls virt_to_folio(NULL), dereferencing an invalid address and
causing a kernel crash.

 Call Trace:
  xfs_buf_free+0x25f/0x510
  xfs_buf_alloc+0xc98/0x19b0
  xfs_buf_find_insert+0x55/0x14d0
  xfs_buf_get_map+0x122b/0x17c0
  xfbtree_init_leaf_block+0x11c/0x4a0
  xfbtree_init+0x1bb/0x460
  xrep_rmap_setup_scan+0x100/0x1f0
  xrep_rmapbt+0x41/0xc0

Fix this by skipping folio_put() when bp->b_addr is NULL.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.