CVE-2026-43158 - Vulnerability Details

- xfs: fix freemap adjustments when adding xattrs to leaf blocks

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix freemap adjustments when adding xattrs to leaf blocks

xfs/592 and xfs/794 both trip this assertion in the leaf block freemap
adjustment code after ~20 minutes of running on my test VMs:

ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)
+ xfs_attr3_leaf_hdr_size(leaf));

Upon enabling quite a lot more debugging code, I narrowed this down to
fsstress trying to set a local extended attribute with namelen=3 and
valuelen=71. This results in an entry size of 80 bytes.

At the start of xfs_attr3_leaf_add_work, the freemap looks like this:

i 0 base 448 size 0 rhs 448 count 46
i 1 base 388 size 132 rhs 448 count 46
i 2 base 2120 size 4 rhs 448 count 46
firstused = 520

where "rhs" is the first byte past the end of the leaf entry array.
This is inconsistent -- the entries array ends at byte 448, but
freemap[1] says there's free space starting at byte 388!

By the end of the function, the freemap is in worse shape:

i 0 base 456 size 0 rhs 456 count 47
i 1 base 388 size 52 rhs 456 count 47
i 2 base 2120 size 4 rhs 456 count 47
firstused = 440

Important note: 388 is not aligned with the entries array element size
of 8 bytes.

Based on the incorrect freemap, the name area starts at byte 440, which
is below the end of the entries array! That's why the assertion
triggers and the filesystem shuts down.

How did we end up here? First, recall from the previous patch that the
freemap array in an xattr leaf block is not intended to be a
comprehensive map of all free space in the leaf block. In other words,
it's perfectly legal to have a leaf block with:

* 376 bytes in use by the entries array
* freemap[0] has [base = 376, size = 8]
* freemap[1] has [base = 388, size = 1500]
* the space between 376 and 388 is free, but the freemap stopped
tracking that some time ago

If we add one xattr, the entries array grows to 384 bytes, and
freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we
add a second xattr, the entries array grows to 392 bytes, and freemap[0]
gets pushed up to [base = 392, size = 0]. This is bad, because
freemap[1] hasn't been updated, and now the entries array and the free
space claim the same space.

The fix here is to adjust all freemap entries so that none of them
collide with the entries array. Note that this fix relies on commit
2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and
the previous patch that resets zero length freemap entries to have
base = 0.

Published: 2026-05-06

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The XFS filesystem’s leaf block freemap mechanism incorrectly updates free space mappings when multiple extended attributes are added. This mismatch causes the freemap entries and the attribute entry array to overlap, triggering an internal assertion that forces the kernel to panic. The result is a denial of service manifested as a kernel crash, affecting all processes running on the affected system. The flaw involves incorrect bounds handling, memory mapping inconsistencies, and invalid memory access issues, corresponding to CWE-664.

Affected Systems

All Linux kernel installations that use the XFS filesystem and still contain the pre‑fix freemap adjustment logic are affected. Because the CVE payload does not list a version range, any kernel until the commit that introduced the fix (e.g., commit 24ce718) may be vulnerable. Systems running recent kernel releases since that change are considered safe.

Risk and Exploitability

With a base CVSS score of 8.8, the vulnerability has a high impact. The EPSS score is below 1%, and the issue is not in the CISA KEV catalog, indicating a low likelihood of exploitation in the wild. Attackers need local, writeable access to an XFS filesystem to add or modify extended attributes that trigger the faulty logic. There is no arbitrary code execution; the consequence is limited to a kernel panic and service disruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d08976725355b9d54d8332fce223fa281cc304a5
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6a8737afbccc340e718e0b22577312826390be8b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a396b3d73d51355e50acdb403ba9c4cae4c1174e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 38613c01f69e1e77e6b8acab1e8ac665d01c2f15
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ef42a8766ff3fdf51cf72fb36d0859c09d134478
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 43f3b18679615a93bd848afde3602ba160637a46
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 24ce71852f2cee6581e2cbebc15489ed52bf63b7
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.252`	unaffected	≤ 5.10.*
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d08976725355b9d54d8332fce223fa281cc304a5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6a8737afbccc340e718e0b22577312826390be8b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a396b3d73d51355e50acdb403ba9c4cae4c1174e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,38613c01f69e1e77e6b8acab1e8ac665d01c2f15)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ef42a8766ff3fdf51cf72fb36d0859c09d134478)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,43f3b18679615a93bd848afde3602ba160637a46)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,24ce71852f2cee6581e2cbebc15489ed52bf63b7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3eefc0c2b78444b64feeb3783c017d6adc3cd3ce)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.252,5.11.0)`	unaffected	semver	—
`[5.15.202,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the freemap adjustment fix (e.g., commit 24ce718 or later).
If an immediate upgrade is not feasible, limit the use of large or frequent extended attributes on critical XFS filesystems, or disable xattr creation for selected files or directories through filesystem permissions or application configuration.
Continuously monitor kernel logs such as dmesg and XFS‑specific error logs for assertions or panics, and take corrective action if such errors appear.

Generated by OpenCVE AI on October 23, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00469.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/24ce71852f2cee6581e2cbebc15489ed52bf63b7
https://git.kernel.org/stable/c/38613c01f69e1e77e6b8acab1e8ac665d01c2f15
https://git.kernel.org/stable/c/3eefc0c2b78444b64feeb3783c017d6adc3cd3ce
https://git.kernel.org/stable/c/43f3b18679615a93bd848afde3602ba160637a46
https://git.kernel.org/stable/c/6a8737afbccc340e718e0b22577312826390be8b
https://git.kernel.org/stable/c/a396b3d73d51355e50acdb403ba9c4cae4c1174e
https://git.kernel.org/stable/c/d08976725355b9d54d8332fce223fa281cc304a5
https://git.kernel.org/stable/c/ef42a8766ff3fdf51cf72fb36d0859c09d134478
https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43158-cc20@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43158
https://www.cve.org/CVERecord?id=CVE-2026-43158

History

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-664

Fri, 16 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 13 May 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.12:-:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::

Fri, 08 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 07 May 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-665

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-131
References		https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43158-cc20@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43158 https://www.cve.org/CVERecord?id=CVE-2026-43158
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Wed, 06 May 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-665

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test VMs: ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) + xfs_attr3_leaf_hdr_size(leaf)); Upon enabling quite a lot more debugging code, I narrowed this down to fsstress trying to set a local extended attribute with namelen=3 and valuelen=71. This results in an entry size of 80 bytes. At the start of xfs_attr3_leaf_add_work, the freemap looks like this: i 0 base 448 size 0 rhs 448 count 46 i 1 base 388 size 132 rhs 448 count 46 i 2 base 2120 size 4 rhs 448 count 46 firstused = 520 where "rhs" is the first byte past the end of the leaf entry array. This is inconsistent -- the entries array ends at byte 448, but freemap[1] says there's free space starting at byte 388! By the end of the function, the freemap is in worse shape: i 0 base 456 size 0 rhs 456 count 47 i 1 base 388 size 52 rhs 456 count 47 i 2 base 2120 size 4 rhs 456 count 47 firstused = 440 Important note: 388 is not aligned with the entries array element size of 8 bytes. Based on the incorrect freemap, the name area starts at byte 440, which is below the end of the entries array! That's why the assertion triggers and the filesystem shuts down. How did we end up here? First, recall from the previous patch that the freemap array in an xattr leaf block is not intended to be a comprehensive map of all free space in the leaf block. In other words, it's perfectly legal to have a leaf block with: * 376 bytes in use by the entries array * freemap[0] has [base = 376, size = 8] * freemap[1] has [base = 388, size = 1500] * the space between 376 and 388 is free, but the freemap stopped tracking that some time ago If we add one xattr, the entries array grows to 384 bytes, and freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we add a second xattr, the entries array grows to 392 bytes, and freemap[0] gets pushed up to [base = 392, size = 0]. This is bad, because freemap[1] hasn't been updated, and now the entries array and the free space claim the same space. The fix here is to adjust all freemap entries so that none of them collide with the entries array. Note that this fix relies on commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and the previous patch that resets zero length freemap entries to have base = 0.
Title		xfs: fix freemap adjustments when adding xattrs to leaf blocks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24ce71852f2cee6581e2cbebc15489ed52bf63b7 https://git.kernel.org/stable/c/38613c01f69e1e77e6b8acab1e8ac665d01c2f15 https://git.kernel.org/stable/c/3eefc0c2b78444b64feeb3783c017d6adc3cd3ce https://git.kernel.org/stable/c/43f3b18679615a93bd848afde3602ba160637a46 https://git.kernel.org/stable/c/6a8737afbccc340e718e0b22577312826390be8b https://git.kernel.org/stable/c/a396b3d73d51355e50acdb403ba9c4cae4c1174e https://git.kernel.org/stable/c/d08976725355b9d54d8332fce223fa281cc304a5 https://git.kernel.org/stable/c/ef42a8766ff3fdf51cf72fb36d0859c09d134478

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T11:27:37.848Z

Updated: 2026-10-19T19:16:22.481Z

Reserved: 2026-05-01T14:12:55.990Z

Link: CVE-2026-43158

Vulnrichment

Updated: 2026-10-16T15:15:15.792Z

NVD

Status : Modified

Published: 2026-05-06T12:16:33.697

Modified: 2026-10-19T20:18:08.823

Link: CVE-2026-43158

Redhat

Severity : Important

Publid Date: 2026-05-06T00:00:00Z

Links: CVE-2026-43158 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T02:30:15Z

Weaknesses

CWE-131
Incorrect Calculation of Buffer Size
CWE-664
Improper Control of a Resource Through its Lifetime
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object