CVE-2026-43474: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43474 Overview

CVE-2026-43474 is an uninitialized memory use vulnerability in the Linux kernel's file attribute subsystem. The flaw resides in the fs/file_attr.c code path that invokes vfs_fileattr_get() without first initializing the flags_valid field of the local file_kattr structure. The syzbot fuzzer detected the issue through the Kernel Memory Sanitizer (KMSAN), which reported an uninit-value read inside fuse_fileattr_get() at fs/fuse/ioctl.c:517. The local variable fa.i allocated in __do_sys_file_getattr was consumed before initialization. The kernel maintainers have resolved the bug by initializing flags_valid prior to calling vfs_fileattr_get().

Critical Impact
Local userspace callers of the file_getattr syscall can trigger reads of uninitialized kernel stack memory, potentially leading to information disclosure or undefined kernel behavior on FUSE-backed filesystems.

Affected Products

Linux kernel versions containing the file_getattr syscall implementation prior to the fix commits
FUSE (Filesystem in Userspace) subsystem consumers of vfs_fileattr_get()
Distributions shipping the affected upstream kernel revisions

Discovery Timeline

2026-05-08 - CVE-2026-43474 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43474

Vulnerability Analysis

The vulnerability is an Uninitialized Memory Use issue in the Linux virtual filesystem (VFS) layer. The syscall handler __do_sys_file_getattr in fs/file_attr.c declares a local struct file_kattr fa on the stack. The handler then passes &fa to vfs_fileattr_get() (defined at fs/file_attr.c:94), which dispatches to filesystem-specific callbacks such as fuse_fileattr_get() in fs/fuse/ioctl.c. The downstream callee reads the flags_valid member of the structure before any code path has written to it.

KMSAN detected the read at fs/fuse/ioctl.c:517 and traced the unwritten allocation back to the fa.i declaration in __do_sys_file_getattr at fs/file_attr.c:380. Reading an uninitialized stack member produces nondeterministic behavior. The leaked bits originate from prior stack frames belonging to kernel code that previously occupied the same memory region.

Root Cause

The "set" code path forgot to apply the initialization pattern already used by the corresponding "get" context. In the get context, the kernel zero-initializes the internal file_kattr structure before handing it to vfs_fileattr_get(). The set path that consumes the user-supplied fa argument did not perform the equivalent initialization on flags_valid, leaving the field indeterminate when FUSE filesystem handlers inspected it.

Attack Vector

A local unprivileged user can invoke the file_getattr syscall against a FUSE-mounted file descriptor to reach the vulnerable code path. The user does not need to supply a malicious file image. Repeated invocation under controlled stack-priming sequences may allow an attacker to influence the residual stack contents that get reused as flags_valid. This can produce inconsistent attribute results or expose fragments of prior kernel stack data to userspace consumers of the syscall return value.

The upstream fix can be reviewed in the kernel git tree at kernel.org commit 379e19e820dd, commit b8c182b2c8c4, and commit cb184dd19154.

Detection Methods for CVE-2026-43474

Indicators of Compromise

KMSAN or KASAN warnings referencing fuse_fileattr_get or vfs_fileattr_get in kernel logs (dmesg)
Unexpected file_getattr syscall invocations against FUSE mount points from unprivileged processes
Anomalous attribute return values from FUSE filesystems that fluctuate across repeated identical queries

Detection Strategies

Run kernels compiled with CONFIG_KMSAN=y in test environments to surface uninitialized-value reads at the flags_valid access site
Audit syslog and journalctl output for kernel BUG, WARN, or sanitizer reports referencing fs/fuse/ioctl.c:517
Compare running kernel build metadata against the fix commits 379e19e820dd, b8c182b2c8c4, and cb184dd19154 to confirm patch presence

Monitoring Recommendations

Enable kernel auditd rules to log file_getattr syscall usage by non-root accounts on multi-tenant hosts
Track FUSE mount activity, especially user-controlled FUSE daemons running alongside the affected syscall consumers
Correlate kernel oops or warning telemetry with process trees to identify reconnaissance or fuzzing attempts targeting the VFS attribute interfaces

How to Mitigate CVE-2026-43474

Immediate Actions Required

Inventory all Linux hosts running kernels that include the file_getattr syscall and identify those without the fix commits applied
Apply the upstream patches 379e19e820dd, b8c182b2c8c4, and cb184dd19154 or the equivalent stable backports from your distribution vendor
Restrict use of unprivileged FUSE mounts on shared and multi-tenant systems until patches are deployed

Patch Information

The fix initializes flags_valid in the file_kattr structure before vfs_fileattr_get() is called, mirroring the initialization pattern already used in the get context. Patched code is available in the mainline and stable kernel trees via the commits listed in the Linux kernel git repository. Distribution maintainers including Debian, Ubuntu, Red Hat, and SUSE typically backport such VFS fixes to supported stable branches; consult the relevant vendor advisory for your build.

Workarounds

Disable or restrict unprivileged FUSE mounts via sysctl fs.fuse.allow_other policy and /etc/fuse.conf configuration where feasible
Limit access to the file_getattr syscall surface using seccomp-bpf profiles for untrusted workloads and container runtimes
Apply namespace and capability constraints to prevent unprivileged users from creating FUSE-backed filesystems on production hosts

bash

# Verify whether the running kernel includes the fix commits
uname -r
zgrep -E 'flags_valid|vfs_fileattr_get' /proc/config.gz 2>/dev/null

# Restrict FUSE usage for non-root users (example seccomp filter scope)
echo 'install fuse /bin/true' | sudo tee /etc/modprobe.d/disable-fuse.conf

# Confirm patch level on Debian/Ubuntu
apt changelog linux-image-$(uname -r) | grep -i 'file_attr\|fileattr_get'