CVE-2026-43153 (GCVE-0-2026-43153)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-10-30 12:25
VLAI
Title
xfs: remove xfs_attr_leaf_hasname
Summary
In the Linux kernel, the following vulnerability has been resolved: xfs: remove xfs_attr_leaf_hasname The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:15 UTC
CWE
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < dfb3474230d392f809359f15aeaa9be4b1798199 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 759e44a6cba8e81d945ffc269a326ec39e7f54f5 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 2fbc8421d1db102c0e5458607e042a23a03648b1 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 457121c01f609b9934addbb04d5c1ef638c71c61 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 530082df991903f3330354e99e0cb7b05debfa86 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43153",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:15:12.446055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:16:22.333Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dfb3474230d392f809359f15aeaa9be4b1798199",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "759e44a6cba8e81d945ffc269a326ec39e7f54f5",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "2fbc8421d1db102c0e5458607e042a23a03648b1",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "457121c01f609b9934addbb04d5c1ef638c71c61",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "530082df991903f3330354e99e0cb7b05debfa86",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "3a65ea768b8094e4699e72f9ab420eb9e0f3f568",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: remove xfs_attr_leaf_hasname\n\nThe calling convention of xfs_attr_leaf_hasname() is problematic, because\nit returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer\nwhen xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a\nnon-NULL buffer pointer for an already released buffer when\nxfs_attr3_leaf_lookup_int fails with other error values.\n\nFix this by simply open coding xfs_attr_leaf_hasname in the callers, so\nthat the buffer release code is done by each caller of\nxfs_attr3_leaf_read."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable XFS attr path is reached through local extended-attribute syscalls such as setxattr/removexattr on a mounted XFS filesystem, not through network packet processing.\nAC:L - Given a crafted or corrupted one-block XFS attribute leaf, the erroneous buffer release path is deterministic and does not require winning a race or depending on heap layout to trigger.\nPR:L - An unprivileged local user can reach the update path through user.* xattrs on regular files or directories for which they have normal write permission; the trigger does not require CAP_SYS_ADMIN once the filesystem is mounted.\nUI:N - The attacker can invoke the xattr operation directly; no additional victim action is needed for the vulnerable code path after the XFS filesystem is available.\nS:U - The corruption occurs inside the kernel/XFS buffer management path and does not cross a separate security authority such as a VM or device isolation boundary.\nC:H - The stale xfs_buf pointer can be released a second time, creating use-after-free/refcount corruption in kernel buffer/log-item objects, which can reasonably support kernel memory disclosure primitives.\nI:H - The double release is kernel memory corruption of reusable buffer-management objects, which is reasonably treatable as exploitable for arbitrary write or control-flow impact under the required higher-severity rule.\nA:H - At minimum, the stale or already freed buffer/log-item path can cause a kernel oops, panic, deadlock, or filesystem shutdown when repeatedly triggered."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:25:04.870Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dfb3474230d392f809359f15aeaa9be4b1798199"
        },
        {
          "url": "https://git.kernel.org/stable/c/759e44a6cba8e81d945ffc269a326ec39e7f54f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61"
        },
        {
          "url": "https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568"
        }
      ],
      "title": "xfs: remove xfs_attr_leaf_hasname",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43153",
    "datePublished": "2026-05-06T11:27:34.446Z",
    "dateReserved": "2026-05-01T14:12:55.989Z",
    "dateUpdated": "2026-10-30T12:25:04.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43153",
      "date": "2026-11-13",
      "epss": "0.00176",
      "percentile": "0.07186"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-05T15:09:35.000Z",
      "cve": "CVE-2026-43153",
      "id": "msrc_CVE-2026-43153",
      "initial_release_date": "2026-05-07T01:07:17.000Z",
      "product_status:known_affected": "12",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xfs: remove xfs_attr_leaf_hasname",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43153.json",
      "version": "16"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/xfs/libxfs/xfs_attr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "dfb3474230d392f809359f15aeaa9be4b1798199",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "759e44a6cba8e81d945ffc269a326ec39e7f54f5",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2fbc8421d1db102c0e5458607e042a23a03648b1",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "457121c01f609b9934addbb04d5c1ef638c71c61",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "530082df991903f3330354e99e0cb7b05debfa86",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3a65ea768b8094e4699e72f9ab420eb9e0f3f568",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/xfs/libxfs/xfs_attr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.9"
                  },
                  {
                    "lessThan": "5.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F0FB6DE3-7F78-4DBC-83E3-1ACA0F4DC0E4",
                    "versionEndExcluding": "6.12.75",
                    "versionStartIncluding": "5.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B",
                    "versionEndExcluding": "6.18.16",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                    "versionEndExcluding": "6.19.6",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: remove xfs_attr_leaf_hasname\n\nThe calling convention of xfs_attr_leaf_hasname() is problematic, because\nit returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer\nwhen xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a\nnon-NULL buffer pointer for an already released buffer when\nxfs_attr3_leaf_lookup_int fails with other error values.\n\nFix this by simply open coding xfs_attr_leaf_hasname in the callers, so\nthat the buffer release code is done by each caller of\nxfs_attr3_leaf_read."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: eliminar xfs_attr_leaf_hasname\n\nLa convenci\u00f3n de llamada de xfs_attr_leaf_hasname() es problem\u00e1tica, porque devuelve un b\u00fafer NULL cuando xfs_attr3_leaf_read falla, un b\u00fafer v\u00e1lido cuando xfs_attr3_leaf_lookup_int devuelve -ENOATTR o -EEXIST, y un puntero de b\u00fafer no-NULL para un b\u00fafer ya liberado cuando xfs_attr3_leaf_lookup_int falla con otros valores de error.\n\nSolucione esto simplemente codificando abiertamente xfs_attr_leaf_hasname en los llamadores, para que el c\u00f3digo de liberaci\u00f3n del b\u00fafer sea realizado por cada llamador de xfs_attr3_leaf_read."
          }
        ],
        "id": "CVE-2026-43153",
        "lastModified": "2026-11-11T21:10:00.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-43153",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:15:12.446055Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-06T12:16:33.073",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/759e44a6cba8e81d945ffc269a326ec39e7f54f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dfb3474230d392f809359f15aeaa9be4b1798199"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-07T05:01:08+00:00",
      "cve": "CVE-2026-43153",
      "id": "CVE-2026-43153",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "158",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfs: remove xfs_attr_leaf_hasname",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43153.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-11-01T01:00:58Z",
      "cve": "CVE-2026-43153",
      "id": "CVE-2026-43153",
      "initial_release_date": "2026-05-09T02:41:56Z",
      "product_status:known_affected": "542",
      "product_status:known_not_affected": "224",
      "product_status:recommended": "203",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43153",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-43153.json",
      "version": "12"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-43153",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T15:15:12.446055Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T15:15:12.995Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/xfs/libxfs/xfs_attr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "dfb3474230d392f809359f15aeaa9be4b1798199",
                  "status": "affected",
                  "version": "07120f1abdff80f3d1351f733661abe28d609535",
                  "versionType": "git"
                },
                {
                  "lessThan": "759e44a6cba8e81d945ffc269a326ec39e7f54f5",
                  "status": "affected",
                  "version": "07120f1abdff80f3d1351f733661abe28d609535",
                  "versionType": "git"
                },
                {
                  "lessThan": "2fbc8421d1db102c0e5458607e042a23a03648b1",
                  "status": "affected",
                  "version": "07120f1abdff80f3d1351f733661abe28d609535",
                  "versionType": "git"
                },
                {
                  "lessThan": "457121c01f609b9934addbb04d5c1ef638c71c61",
                  "status": "affected",
                  "version": "07120f1abdff80f3d1351f733661abe28d609535",
                  "versionType": "git"
                },
                {
                  "lessThan": "530082df991903f3330354e99e0cb7b05debfa86",
                  "status": "affected",
                  "version": "07120f1abdff80f3d1351f733661abe28d609535",
                  "versionType": "git"
                },
                {
                  "lessThan": "3a65ea768b8094e4699e72f9ab420eb9e0f3f568",
                  "status": "affected",
                  "version": "07120f1abdff80f3d1351f733661abe28d609535",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/xfs/libxfs/xfs_attr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.9"
                },
                {
                  "lessThan": "5.9",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.191",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.160",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.75",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.19.*",
                  "status": "unaffected",
                  "version": "6.19.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.0",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.191",
                      "versionStartIncluding": "5.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.160",
                      "versionStartIncluding": "5.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.75",
                      "versionStartIncluding": "5.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.16",
                      "versionStartIncluding": "5.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.19.6",
                      "versionStartIncluding": "5.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.0",
                      "versionStartIncluding": "5.9",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: remove xfs_attr_leaf_hasname\n\nThe calling convention of xfs_attr_leaf_hasname() is problematic, because\nit returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer\nwhen xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a\nnon-NULL buffer pointer for an already released buffer when\nxfs_attr3_leaf_lookup_int fails with other error values.\n\nFix this by simply open coding xfs_attr_leaf_hasname in the callers, so\nthat the buffer release code is done by each caller of\nxfs_attr3_leaf_read."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable XFS attr path is reached through local extended-attribute syscalls such as setxattr/removexattr on a mounted XFS filesystem, not through network packet processing.\nAC:L - Given a crafted or corrupted one-block XFS attribute leaf, the erroneous buffer release path is deterministic and does not require winning a race or depending on heap layout to trigger.\nPR:L - An unprivileged local user can reach the update path through user.* xattrs on regular files or directories for which they have normal write permission; the trigger does not require CAP_SYS_ADMIN once the filesystem is mounted.\nUI:N - The attacker can invoke the xattr operation directly; no additional victim action is needed for the vulnerable code path after the XFS filesystem is available.\nS:U - The corruption occurs inside the kernel/XFS buffer management path and does not cross a separate security authority such as a VM or device isolation boundary.\nC:H - The stale xfs_buf pointer can be released a second time, creating use-after-free/refcount corruption in kernel buffer/log-item objects, which can reasonably support kernel memory disclosure primitives.\nI:H - The double release is kernel memory corruption of reusable buffer-management objects, which is reasonably treatable as exploitable for arbitrary write or control-flow impact under the required higher-severity rule.\nA:H - At minimum, the stale or already freed buffer/log-item path can cause a kernel oops, panic, deadlock, or filesystem shutdown when repeatedly triggered."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-30T12:25:04.870Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/dfb3474230d392f809359f15aeaa9be4b1798199"
            },
            {
              "url": "https://git.kernel.org/stable/c/759e44a6cba8e81d945ffc269a326ec39e7f54f5"
            },
            {
              "url": "https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1"
            },
            {
              "url": "https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61"
            },
            {
              "url": "https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86"
            },
            {
              "url": "https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568"
            }
          ],
          "title": "xfs: remove xfs_attr_leaf_hasname",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-43153",
        "datePublished": "2026-05-06T11:27:34.446Z",
        "dateReserved": "2026-05-01T14:12:55.989Z",
        "dateUpdated": "2026-10-30T12:25:04.870Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.