What is the CVSS score of CVE-2026-23250?

CVE-2026-23250 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23250?

Yes, a patch is available for CVE-2026-23250. Update the affected software to the latest version immediately.

Linux CVE-2026-23250

EUVD-2026-12854 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-03-18 Linux

Linux Denial Of Service Null Pointer Dereference Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

May 21, 2026 - 18:37 NVD

5.5 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 17:30 euvd

EUVD-2026-12854

Analysis Generated

Mar 18, 2026 - 17:30 vuln.today

CVE Published

Mar 18, 2026 - 17:01 nvd

N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfs: check return value of xchk_scrub_create_subord

Fix this function to return NULL instead of a mangled ENOMEM, then fix the callers to actually check for a null pointer and return ENOMEM. Most of the corrections here are for code merged between 6.2 and 6.10.

AnalysisAI

A null pointer dereference vulnerability exists in the XFS filesystem checker (xchk_scrub_create_subord) in the Linux kernel, where the function returns a mangled ENOMEM error instead of NULL, and callers fail to properly validate the return value. This affects Linux kernel versions 6.2 through 6.10 and later stable branches, potentially allowing a local attacker with filesystem access to trigger a denial of service condition through unhandled memory allocation failures during XFS filesystem integrity checks.

Technical ContextAI

The vulnerability is rooted in improper error handling within the XFS (eXtended File System) scrub subsystem, specifically in the xchk_scrub_create_subord function introduced between kernel versions 6.2 and 6.10. The root cause is classified as improper input validation and insufficient error checking (CWE context suggests CWE-252: Unchecked Return Value or similar error handling deficiencies). The function is part of the Linux kernel's filesystem integrity checking infrastructure (CPE: cpe:2.3:a:linux:linux). When memory allocation fails, the function incorrectly mangles the ENOMEM error code rather than returning a NULL pointer, causing calling functions to misinterpret the error state and proceed without proper bounds checking or error recovery.

RemediationAI

Upgrade to a patched kernel version incorporating one of the following fixes: commit d6f3f7d4dd8a179394cef03c00993d57f5f68601, 2b658d1249666cc55af9484dcf5f45ca438d4ecc, b2df809edd8cb7d1c3e19d9f6aabc2bd55d2bfb6, or ca27313fb3f23e4ac18532ede4ec1c7cc5814c4a. Consult your distribution's advisory for backported patches (Red Hat, Canonical, SUSE, etc. have released updates). Until patching is possible, disable XFS scrub operations if not actively using filesystem integrity checks, or restrict access to scrub interfaces via filesystem permissions. Monitor system logs for xfs_scrub errors or unexpected kernel panics, which may indicate exploitation attempts.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	not-affected	-	-
bookworm (security)	fixed	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky	fixed	6.19.6-2	-
sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.6-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-23250 vulnerability details – vuln.today

Back

Linux CVE-2026-23250

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code