CVE-2026-43365 - Vulnerability Details

- xfs: fix undersized l_iclog_roundoff values

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix undersized l_iclog_roundoff values

If the superblock doesn't list a log stripe unit, we set the incore log
roundoff value to 512. This leads to corrupt logs and unmountable
filesystems in generic/617 on a disk with 4k physical sectors...

XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c
XFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197.
XFS (sda1): failed to locate log tail
XFS (sda1): log mount/recovery failed: error -74
XFS (sda1): log mount failed
XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c
XFS (sda1): Ending clean mount

...on the current xfsprogs for-next which has a broken mkfs. xfs_info
shows this...

meta-data=/dev/sda1 isize=512 agcount=4, agsize=644992 blks
= sectsz=4096 attr=2, projid32bit=1
= crc=1 finobt=1, sparse=1, rmapbt=1
= reflink=1 bigtime=1 inobtcount=1 nrext64=1
= exchange=1 metadir=1
data = bsize=4096 blocks=2579968, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=1
log =internal log bsize=4096 blocks=16384, version=2
= sectsz=4096 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
= rgcount=0 rgsize=268435456 extents
= zoned=0 start=0 reserved=0

...observe that the log section has sectsz=4096 sunit=0, which means
that the roundoff factor is 512, not 4096 as you'd expect. We should
fix mkfs not to generate broken filesystems, but anyone can fuzz the
ondisk superblock so we should be more cautious. I think the inadequate
logic predates commit a6a65fef5ef8d0, but that's clearly going to
require a different backport.

Published: 2026-05-08

Score: 8.2 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s XFS module sets the in‑kernel log round‑off value to an undersized 512‑byte default when the filesystem superblock does not provide a log stripe unit. This incorrect calculation misaligns the transaction log, leading to CRC errors, unmountable filesystems, and potential loss or corruption of stored data. The vulnerability is based on improper handling of log alignment parameters.

Affected Systems

The issue exists in all Linux kernel builds that include the unpatched XFS implementation, including the generic kernel and the 7.0 release candidates. Any system running one of these kernels with the current XFS code is vulnerable until the patch is incorporated.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.2 and an EPSS score of less than 1%, indicating a high severity but a low likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged access that allows an attacker to write or manipulate a filesystem superblock, for example by using a faulty mkfs tool or by delivering a crafted superblock payload.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48`	affected	< 5afae524f83d6a18517298491a5624cb0eae5029
`a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48`	affected	< 2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40
`a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48`	affected	< 41e91dff2d3974730b5ee50daa8e27ec254cbf91
`a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48`	affected	< e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d
`a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48`	affected	< 446a1f5bb64ba38adb93cb043ff0f7b85e8937ca
`a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48`	affected	< 5e7148402dfc4a5b7894d8e97b15e5c2e70924aa
`a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48`	affected	< 52a8a1ba883defbfe3200baa22cf4cd21985d51a

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.19`	unaffected	≤ 6.18.*
`6.19.9`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48,5afae524f83d6a18517298491a5624cb0eae5029)`	affected	code_commit	—
`[a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48,2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40)`	affected	code_commit	—
`[a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48,41e91dff2d3974730b5ee50daa8e27ec254cbf91)`	affected	code_commit	—
`[a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48,e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d)`	affected	code_commit	—
`[a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48,446a1f5bb64ba38adb93cb043ff0f7b85e8937ca)`	affected	code_commit	—
`[a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48,5e7148402dfc4a5b7894d8e97b15e5c2e70924aa)`	affected	code_commit	—
`[a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48,52a8a1ba883defbfe3200baa22cf4cd21985d51a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.19,6.19.0)`	unaffected	semver	—
`[6.19.9,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel version that contains the XFS round‑off fix
Back up existing data and recreate the affected XFS filesystems with a recent xfsprogs build that sets correct sector and stride values before mounting
If immediate kernel upgrade is not possible, patch or replace the local mkfs utility so that it writes the correct sunit and sectsz fields into the superblock

Generated by OpenCVE AI on May 15, 2026 at 18:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0007.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40
https://git.kernel.org/stable/c/41e91dff2d3974730b5ee50daa8e27ec254cbf91
https://git.kernel.org/stable/c/446a1f5bb64ba38adb93cb043ff0f7b85e8937ca
https://git.kernel.org/stable/c/52a8a1ba883defbfe3200baa22cf4cd21985d51a
https://git.kernel.org/stable/c/5afae524f83d6a18517298491a5624cb0eae5029
https://git.kernel.org/stable/c/5e7148402dfc4a5b7894d8e97b15e5c2e70924aa
https://git.kernel.org/stable/c/e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d
https://lore.kernel.org/linux-cve-announce/2026050827-CVE-2026-43365-b7ce@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43365
https://www.cve.org/CVERecord?id=CVE-2026-43365

History

Fri, 15 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::

Mon, 11 May 2026 07:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}`

Sat, 09 May 2026 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-190

Sat, 09 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-166
References		https://lore.kernel.org/linux-cve-announce/2026050827-CVE-2026-43365-b7ce@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43365 https://www.cve.org/CVERecord?id=CVE-2026-43365
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 08 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190

Fri, 08 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized l_iclog_roundoff values If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k physical sectors... XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197. XFS (sda1): failed to locate log tail XFS (sda1): log mount/recovery failed: error -74 XFS (sda1): log mount failed XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Ending clean mount ...on the current xfsprogs for-next which has a broken mkfs. xfs_info shows this... meta-data=/dev/sda1 isize=512 agcount=4, agsize=644992 blks = sectsz=4096 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 = exchange=1 metadir=1 data = bsize=4096 blocks=2579968, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=1 log =internal log bsize=4096 blocks=16384, version=2 = sectsz=4096 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 = rgcount=0 rgsize=268435456 extents = zoned=0 start=0 reserved=0 ...observe that the log section has sectsz=4096 sunit=0, which means that the roundoff factor is 512, not 4096 as you'd expect. We should fix mkfs not to generate broken filesystems, but anyone can fuzz the ondisk superblock so we should be more cautious. I think the inadequate logic predates commit a6a65fef5ef8d0, but that's clearly going to require a different backport.
Title		xfs: fix undersized l_iclog_roundoff values
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40 https://git.kernel.org/stable/c/41e91dff2d3974730b5ee50daa8e27ec254cbf91 https://git.kernel.org/stable/c/446a1f5bb64ba38adb93cb043ff0f7b85e8937ca https://git.kernel.org/stable/c/52a8a1ba883defbfe3200baa22cf4cd21985d51a https://git.kernel.org/stable/c/5afae524f83d6a18517298491a5624cb0eae5029 https://git.kernel.org/stable/c/5e7148402dfc4a5b7894d8e97b15e5c2e70924aa https://git.kernel.org/stable/c/e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-08T14:21:18.405Z

Updated: 2026-05-11T22:23:10.719Z

Reserved: 2026-05-01T14:12:56.005Z

Link: CVE-2026-43365

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-08T15:16:47.490

Modified: 2026-05-15T16:15:14.250

Link: CVE-2026-43365

Redhat

Severity : Moderate

Publid Date: 2026-05-08T00:00:00Z

Links: CVE-2026-43365 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-15T19:00:07Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object