CVE-2026-43187: Linux Kernel Privilege Escalation Issue

CVE-2026-43187 Overview

CVE-2026-43187 is a Linux kernel vulnerability in the XFS filesystem affecting the extended attribute (xattr) leaf block management code. The flaw resides in the attribute leaf freemap handling, where a freemap entry can retain a nonzero base after its size underflows to zero. Subsequent setxattr operations can advance the base until it overlaps another freemap entry, producing inconsistent free-space tracking. A related defect in _leaf_add can then permit allocation of xattr namevalue entries on top of the existing entries array, resulting in on-disk data loss. According to the upstream commit message, the underlying defect has existed in the codebase for an extended period.

Critical Impact
Inconsistent XFS attribute leaf freemap state can lead to xattr entries being overwritten, causing local data loss on affected Linux systems.

Affected Products

Linux kernel (XFS filesystem subsystem)
Multiple stable kernel branches receiving the backported fix
Distributions shipping vulnerable XFS code prior to the patched commits

Discovery Timeline

2026-05-06 - CVE-2026-43187 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43187

Vulnerability Analysis

The vulnerability lives in the XFS attribute leaf block code path that manages free space within a leaf via the freemap array. The freemap contains only three entries and is not a complete index of free space inside the leaf block. When the xattr entries array expands, the code subtracts consumed bytes from a small trailing freemap entry, which can underflow to zero size while leaving its base field nonzero.

A later setxattr operation can increment the stale base until it overlaps another freemap entry. The free-space search logic in xfs_attr3_leaf_add ignores zero-sized freemap entries, so this state alone is not exploitable. However, the same function fails to update a freemap entry whose base falls in the middle of a newly appended xattr entry. The freemap can then hold two entries that share a base but report different sizes.

Root Cause

The root cause is incomplete bookkeeping in the XFS attribute leaf freemap update logic [CWE-682, incorrect calculation]. The original fix in commit 2a2b5932db6758 addressed the size underflow but did not zero out the base of empty freemap entries, and _leaf_add does not reconcile freemap entries whose base lies inside a freshly written namevalue region.

Attack Vector

Exploitation requires a local actor capable of issuing setxattr system calls against files on an XFS filesystem. By crafting a sequence of attribute additions and removals that drives a freemap entry to zero size with a nonzero base, an attacker can induce subsequent allocations to overwrite existing xattr namevalue data. The patched code zeroes the base of any zero-sized freemap entry, and a later allocation failure triggers block compaction, which regenerates a consistent freemap.

No verified public proof-of-concept code is available for this issue. See the upstream kernel commits for technical detail.

Detection Methods for CVE-2026-43187

Indicators of Compromise

Unexpected loss or corruption of extended attributes on XFS-formatted volumes following heavy setxattr workloads
XFS metadata warnings or xfs_repair reports flagging inconsistent attribute leaf blocks
Kernel log entries from the XFS subsystem referencing attribute leaf or freemap anomalies

Detection Strategies

Audit kernel package versions across Linux fleets and flag hosts running XFS on kernels predating the fix commits referenced in the upstream advisory
Monitor auditd for unusual volumes of setxattr, removexattr, and listxattr syscalls from non-administrative users
Run periodic offline xfs_repair -n checks on critical XFS volumes to identify attribute leaf inconsistencies

Monitoring Recommendations

Centralize kernel ring buffer (dmesg) and journalctl output to a SIEM and alert on XFS attribute or corruption messages
Track filesystem integrity baselines for files relying on extended attributes, including SELinux and capability labels
Correlate filesystem anomaly alerts with process telemetry to identify the workload triggering anomalous xattr activity

How to Mitigate CVE-2026-43187

Immediate Actions Required

Apply the patched kernel package from your Linux distribution as soon as it is released for your branch
Inventory all systems using XFS with extended attributes enabled and prioritize patching of multi-tenant and shared hosts
Restrict local shell access on systems pending patches, since exploitation requires the ability to issue xattr syscalls

Patch Information

The fix zeroes out the base of any freemap entry whose size has dropped to zero, eliminating the stale-base condition that drives the inconsistency. Upstream patches are available in the following kernel commits: 479b05f, 6f13c1d, a631899, aa9083d, e1b8c64, f31a833, f3c0d1f, and ffaf5c99.

Workarounds

Maintain current backups of XFS volumes and verify restorability of files that rely on extended attributes
Limit untrusted local user access on systems hosting XFS filesystems until patches are deployed
Where feasible, reduce the volume of dynamic xattr churn on production XFS filesystems pending the kernel update

bash

# Identify running kernel and XFS-formatted mounts pending patch verification
uname -r
findmnt -t xfs -o TARGET,SOURCE,FSTYPE
# After patching, reboot into the fixed kernel and verify
uname -r