Look up another CVE · open CVE-2026-43153 in the interactive tracker
CVE-2026-43153
xfs: remove xfs_attr_leaf_hasname
Published 2026-05-06 (5 months ago) by the Linux kernel CNA. Subsystem fs/xfs. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-43153 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.85-1 | Update the kernel and reboot. Fixed in 6.12.85-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.19.6-1 | Update the kernel and reboot. Fixed in 6.19.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.19.6-1 | Update the kernel and reboot. Fixed in 6.19.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/xfs/libxfs/xfs_attr.c
- What this is
- XFS FILESYSTEMMAINTAINERS section matched on fs/xfs/ · linux-xfs@vger.kernel.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-05-06 (5 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/xfs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.9 | 6.12.75 | 2fbc8421d1db |
| 5.9 | 6.18.16 | 457121c01f60 |
| 5.9 | 6.19.6 | 530082df9919 |
| 5.9 | 7.0 | 3a65ea768b80 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable XFS attr path is reached through local extended-attribute syscalls such as setxattr/removexattr on a mounted XFS filesystem, not through network packet processing.
- AC:LAttack complexity, low
- Given a crafted or corrupted one-block XFS attribute leaf, the erroneous buffer release path is deterministic and does not require winning a race or depending on heap layout to trigger.
- PR:LPrivileges required, low
- An unprivileged local user can reach the update path through user.* xattrs on regular files or directories for which they have normal write permission; the trigger does not require CAP_SYS_ADMIN once the filesystem is mounted.
- UI:NUser interaction, none
- The attacker can invoke the xattr operation directly; no additional victim action is needed for the vulnerable code path after the XFS filesystem is available.
- S:UScope, unchanged
- The corruption occurs inside the kernel/XFS buffer management path and does not cross a separate security authority such as a VM or device isolation boundary.
- C:HConfidentiality impact, high
- The stale xfs_buf pointer can be released a second time, creating use-after-free/refcount corruption in kernel buffer/log-item objects, which can reasonably support kernel memory disclosure primitives.
- I:HIntegrity impact, high
- The double release is kernel memory corruption of reusable buffer-management objects, which is reasonably treatable as exploitable for arbitrary write or control-flow impact under the required higher-severity rule.
- A:HAvailability impact, high
- At minimum, the stale or already freed buffer/log-item path can cause a kernel oops, panic, deadlock, or filesystem shutdown when repeatedly triggered.