Executive brief
A vulnerability in the Linux kernel's XFS file system could allow for data loss or corruption. The issue stems from how the system manages free space when handling extended file attributes. If exploited, an attacker could cause the system to overwrite existing file data, potentially leading to permanent information loss or system instability.
Technical details
An integer underflow and logic error in the XFS filesystem's attribute leaf management (xfs_attr_leaf.c) can result in overlapping freemap entries. Specifically, the code can leave behind zero-length freemap entries with non-zero bases; subsequent 'setxattr' operations may fail to update these entries correctly when they begin midway through a newly appended attribute. This leads to a state where the freemap contains duplicate bases for different sizes, causing the kernel to eventually allocate new attribute name-value pairs on top of existing entry arrays. This results in silent data corruption or data loss. The fix involves zeroing out the base of any zero-sized freemap entry to prevent address matching confusion during block compaction.
Affected products
- Linux Linux Kernel 2.6.12 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed: Initial disclosure of CVE-2026-43187
- 2026-05-06: advisory
- 2026-01-23: patched: Fix authored by Darrick J. Wong
References
- https://git.kernel.org/stable/c/479b05fc3ee272090f671b06a41f3da8aa78eece
- https://git.kernel.org/stable/c/6f13c1d2a6271c2e73226864a0e83de2770b6f34
- https://git.kernel.org/stable/c/a631899025d47ea1aa6464d76db5b4d3b6d196fd
- https://git.kernel.org/stable/c/aa9083d97e2157da3c6fb45ddb1a97af7f188f7f
- https://git.kernel.org/stable/c/e1b8c6452ee99a30e188a88f3f3f804fb1c6004a
- https://git.kernel.org/stable/c/f31a8334e1c54b126fcecf98645a49b6bc5ad399
- https://git.kernel.org/stable/c/f3c0d1fc1eadbb4adbee5ab7757d41d35f48325b