CVE-2026-43153: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43153 Overview

CVE-2026-43153 is a vulnerability in the Linux kernel's XFS filesystem code. The flaw involves the xfs_attr_leaf_hasname() function, which has an inconsistent calling convention for buffer handling. The function returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL pointer to an already-released buffer when xfs_attr3_leaf_lookup_int fails with other error values. This inconsistency can lead to use-after-free conditions in callers that attempt to operate on the returned buffer.

Critical Impact
Inconsistent buffer state handling in XFS extended attribute leaf operations may lead to use-after-free or NULL pointer dereference conditions in the Linux kernel.

Affected Products

Linux kernel (XFS filesystem subsystem)
Distributions shipping affected upstream Linux kernel versions
Systems using XFS with extended attribute (xattr) operations

Discovery Timeline

2026-05-06 - CVE-2026-43153 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43153

Vulnerability Analysis

The vulnerability resides in the XFS filesystem's extended attribute (xattr) handling code, specifically in the xfs_attr_leaf_hasname() helper function. XFS uses leaf blocks to store extended attribute entries, and xfs_attr_leaf_hasname() was intended to check whether a given attribute name exists in a leaf block.

The function exhibits three distinct return states for its buffer output parameter, depending on the error path taken. When xfs_attr3_leaf_read fails, callers receive a NULL buffer pointer. When xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, callers receive a valid, still-held buffer. When xfs_attr3_leaf_lookup_int fails with any other error code, callers receive a non-NULL pointer to a buffer that has already been released.

This third case is the dangerous one. A caller that releases the buffer based on the non-NULL pointer will perform a double-release, while a caller that dereferences the buffer touches freed memory.

Root Cause

The root cause is an inconsistent error-handling contract between xfs_attr_leaf_hasname() and its internal helpers. The function does not normalize buffer ownership across all error paths, leaving callers unable to determine safely whether they must release the returned buffer. The upstream fix removes xfs_attr_leaf_hasname() entirely and open-codes the logic in each caller, ensuring buffer release is explicitly handled per call site.

Attack Vector

Exploitation requires triggering specific error paths in XFS extended attribute lookups on a mounted XFS filesystem. An attacker capable of inducing filesystem errors or operating on a crafted XFS image could potentially reach the inconsistent buffer-release path. The vulnerability is reachable through standard xattr syscalls such as getxattr, setxattr, and removexattr against XFS-backed inodes.

No public proof-of-concept exists. The fix has been merged across multiple stable trees as referenced in commits 2fbc842, 3a65ea7, 457121c, and 530082d.

Detection Methods for CVE-2026-43153

Indicators of Compromise

Kernel oops or panic logs referencing xfs_attr_leaf_hasname, xfs_attr3_leaf_read, or xfs_attr3_leaf_lookup_int in the stack trace
Filesystem corruption messages or XFS_CORRUPTION_ERROR reports tied to attribute leaf operations
Unexpected process crashes or memory corruption traces on hosts performing heavy xattr workloads on XFS volumes

Detection Strategies

Inventory Linux hosts running kernels that include the vulnerable xfs_attr_leaf_hasname helper and verify whether the upstream commits referenced above have been applied
Monitor kernel ring buffer (dmesg) and journalctl -k output for XFS subsystem warnings, BUG reports, and use-after-free detections from KASAN-instrumented kernels
Correlate filesystem audit logs with kernel crash telemetry to identify suspicious xattr access patterns preceding instability

Monitoring Recommendations

Enable kernel crash collection (kdump) on production XFS hosts to capture diagnostic data if the vulnerability is triggered
Forward kernel logs to a centralized logging platform and alert on XFS error signatures
Track package and kernel update status across the fleet to confirm patch deployment

How to Mitigate CVE-2026-43153

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that incorporates the fix removing xfs_attr_leaf_hasname
Identify all hosts using XFS as the root or data filesystem and prioritize them for kernel patching
Reboot patched systems to load the updated kernel, since live-patching may not cover filesystem subsystem changes

Patch Information

The upstream Linux kernel fix removes xfs_attr_leaf_hasname() and inlines the buffer-release logic into each caller. Backports are available in the following stable commits: Kernel Git Commit 2fbc842, Kernel Git Commit 3a65ea7, Kernel Git Commit 457121c, and Kernel Git Commit 530082d.

Workarounds

No direct workaround exists for the code path; patching the kernel is the supported remediation
Restrict untrusted local users from mounting arbitrary XFS images, which removes one path to triggering rare error states
Limit the attack surface by enforcing least-privilege access controls on filesystems and avoiding exposure of XFS volumes to untrusted workloads

bash

# Verify running kernel and check for XFS-mounted filesystems
uname -r
mount | grep xfs

# Example: update kernel on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/-[a-z]*$//')
sudo reboot

# Example: update kernel on RHEL/Rocky/Alma systems
sudo dnf update kernel
sudo reboot