Linux CVE-2026-23252

The vulnerability resides in the XFS (X File System) filesystem checking infrastructure within the Linux kernel, specifically in the xchk_xfile_*_descr debugging macros that generate descriptive strings for filesystem checker operations. These macros utilize kasprintf, a kernel memory allocation function that can fail when the formatted string output exceeds internal buffer limitations (typically around 16 bytes in nofail guarantee scenarios). The root cause relates to unbounded string formatting without proper length validation or error handling for allocation failures. The affected CPE is cpe:2.3:a:linux:linux, indicating this impacts the core Linux kernel across multiple versions. The vulnerability class involves resource exhaustion and improper error handling in memory allocation paths, potentially classified under CWE-400 (Uncontrolled Resource Consumption) or CWE-190 (Integer Overflow or Wraparound) if allocation size calculations overflow.