LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23250: xfs: check return value of xchk_scrub_create_subord

In the Linux kernel, the following vulnerability has been resolved: xfs: check return value of xchk_scrub_create_subord Fix this function to return NULL instead of a mangled ENOMEM, then fix the callers to actually check for a null pointer and return ENOMEM. Most of the corrections here are for code merged between 6.2 and 6.10.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23250 is a Linux kernel XFS bug in error handling. A failed helper allocation could be returned incorrectly and not checked by callers. The public record does not state business impact, CVSS severity, or active exploitation, so urgency depends on kernel exposure and vendor guidance.

Executive priority

Handle through normal kernel patch governance, with elevated priority for critical Linux systems using XFS. Current public evidence does not justify emergency action, but incomplete impact data warrants tracking until vendor advisories clarify severity.

Technical view

The fix changes xchk_scrub_create_subord to return NULL instead of a mangled ENOMEM value, and updates callers to detect NULL and return ENOMEM. The issue is in XFS scrub-related kernel code, with affected information tied to Linux kernel versions and stable commits.

Likely exposure

Likely exposure is Linux systems running affected kernel versions listed in the CVE record, especially where XFS functionality is present. Distribution backports may change exposure, so version-only checks are insufficient without vendor package status.

Exploitation context

The source bundle says KEV is false and provides no evidence of active exploitation. It also does not describe attack prerequisites, reachable interfaces, or practical exploitability. Treat exploitation context as unconfirmed.

Researcher notes

The public record is sparse: no CVSS, CWE, exploitability narrative, or affected distribution packages are provided. Analysis should focus on whether XFS scrub code is reachable in deployed kernels and whether vendor kernels have backported the stable fixes.

Mitigation direction

  • Check Linux distribution advisories for CVE-2026-23250 package status.
  • Apply kernel updates that include the referenced stable fixes.
  • Prioritize systems using XFS on important workloads.
  • Track vendor severity if CVSS or impact details are later published.

Validation and detection

  • Inventory Linux kernel versions across servers and images.
  • Identify systems using XFS filesystems or XFS scrub workflows.
  • Confirm installed kernels include the referenced stable commits or vendor backports.
  • Document exceptions where vendor status remains pending or unclear.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23250 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1a5f6e08d4e379a23da5be974aee50b26a20c5b0, 1a5f6e08d4e379a23da5be974aee50b26a20c5b0, 1a5f6e08d4e379a23da5be974aee50b26a20c5b0, 1a5f6e08d4e379a23da5be974aee50b26a20c5b0unaffected
LinuxLinux6.10, 0, 6.12.75, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.