CVE-2026-43153 (GCVE-0-2026-43153)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-08-05 12:26
VLAI
Title
xfs: remove xfs_attr_leaf_hasname
Summary
In the Linux kernel, the following vulnerability has been resolved: xfs: remove xfs_attr_leaf_hasname The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 2fbc8421d1db102c0e5458607e042a23a03648b1 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 457121c01f609b9934addbb04d5c1ef638c71c61 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 530082df991903f3330354e99e0cb7b05debfa86 (git)
Affected: 07120f1abdff80f3d1351f733661abe28d609535 , < 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2fbc8421d1db102c0e5458607e042a23a03648b1",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "457121c01f609b9934addbb04d5c1ef638c71c61",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "530082df991903f3330354e99e0cb7b05debfa86",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            },
            {
              "lessThan": "3a65ea768b8094e4699e72f9ab420eb9e0f3f568",
              "status": "affected",
              "version": "07120f1abdff80f3d1351f733661abe28d609535",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: remove xfs_attr_leaf_hasname\n\nThe calling convention of xfs_attr_leaf_hasname() is problematic, because\nit returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer\nwhen xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a\nnon-NULL buffer pointer for an already released buffer when\nxfs_attr3_leaf_lookup_int fails with other error values.\n\nFix this by simply open coding xfs_attr_leaf_hasname in the callers, so\nthat the buffer release code is done by each caller of\nxfs_attr3_leaf_read."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable XFS attr path is reached through local extended-attribute syscalls such as setxattr/removexattr on a mounted XFS filesystem, not through network packet processing.\nAC:L - Given a crafted or corrupted one-block XFS attribute leaf, the erroneous buffer release path is deterministic and does not require winning a race or depending on heap layout to trigger.\nPR:L - An unprivileged local user can reach the update path through user.* xattrs on regular files or directories for which they have normal write permission; the trigger does not require CAP_SYS_ADMIN once the filesystem is mounted.\nUI:N - The attacker can invoke the xattr operation directly; no additional victim action is needed for the vulnerable code path after the XFS filesystem is available.\nS:U - The corruption occurs inside the kernel/XFS buffer management path and does not cross a separate security authority such as a VM or device isolation boundary.\nC:H - The stale xfs_buf pointer can be released a second time, creating use-after-free/refcount corruption in kernel buffer/log-item objects, which can reasonably support kernel memory disclosure primitives.\nI:H - The double release is kernel memory corruption of reusable buffer-management objects, which is reasonably treatable as exploitable for arbitrary write or control-flow impact under the required higher-severity rule.\nA:H - At minimum, the stale or already freed buffer/log-item path can cause a kernel oops, panic, deadlock, or filesystem shutdown when repeatedly triggered."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:13.566Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61"
        },
        {
          "url": "https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568"
        }
      ],
      "title": "xfs: remove xfs_attr_leaf_hasname",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43153",
    "datePublished": "2026-05-06T11:27:34.446Z",
    "dateReserved": "2026-05-01T14:12:55.989Z",
    "dateUpdated": "2026-08-05T12:26:13.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43153",
      "date": "2026-09-26",
      "epss": "0.00175",
      "percentile": "0.06243"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:45:42.000Z",
      "cve": "CVE-2026-43153",
      "id": "msrc_CVE-2026-43153",
      "initial_release_date": "2026-05-07T01:07:17.000Z",
      "product_status:known_affected": "10",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xfs: remove xfs_attr_leaf_hasname",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43153.json",
      "version": "14"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/xfs/libxfs/xfs_attr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2fbc8421d1db102c0e5458607e042a23a03648b1",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "457121c01f609b9934addbb04d5c1ef638c71c61",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "530082df991903f3330354e99e0cb7b05debfa86",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3a65ea768b8094e4699e72f9ab420eb9e0f3f568",
                    "status": "affected",
                    "version": "07120f1abdff80f3d1351f733661abe28d609535",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/xfs/libxfs/xfs_attr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.9"
                  },
                  {
                    "lessThan": "5.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F0FB6DE3-7F78-4DBC-83E3-1ACA0F4DC0E4",
                    "versionEndExcluding": "6.12.75",
                    "versionStartIncluding": "5.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B",
                    "versionEndExcluding": "6.18.16",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                    "versionEndExcluding": "6.19.6",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: remove xfs_attr_leaf_hasname\n\nThe calling convention of xfs_attr_leaf_hasname() is problematic, because\nit returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer\nwhen xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a\nnon-NULL buffer pointer for an already released buffer when\nxfs_attr3_leaf_lookup_int fails with other error values.\n\nFix this by simply open coding xfs_attr_leaf_hasname in the callers, so\nthat the buffer release code is done by each caller of\nxfs_attr3_leaf_read."
          }
        ],
        "id": "CVE-2026-43153",
        "lastModified": "2026-06-17T10:49:02.063",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-06T12:16:33.073",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T21:44:52+00:00",
      "cve": "CVE-2026-43153",
      "id": "CVE-2026-43153",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfs: remove xfs_attr_leaf_hasname",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43153.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-25T23:56:20Z",
      "cve": "CVE-2026-43153",
      "id": "CVE-2026-43153",
      "initial_release_date": "2026-05-09T02:41:56Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "540",
      "product_status:known_not_affected": "224",
      "product_status:recommended": "172",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43153",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43153.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.