PT-2026-37493 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-07 · CVE-2026-43153

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A problem exists in the XFS filesystem component where the xfs attr leaf hasname() function has a problematic calling convention. The function may return a NULL buffer if xfs attr3 leaf read() fails, a valid buffer when xfs attr3 leaf lookup int() returns -ENOATTR or -EEXIST, or a non-NULL pointer to an already released buffer when xfs attr3 leaf lookup int() fails with other error values. This behavior involving bad pointers can lead to system instability or crashes.

Recommendations As a temporary workaround, restrict operations that trigger the xfs attr leaf hasname() function until a patch is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43153

Affected Products

Linux Kernel

References · 14

• https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43153 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43153 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43153 · Vendor Advisory
• https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86 · Patch
• https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43153 · Security Note
• https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568 · Patch
• https://ubuntu.com/security/CVE-2026-43153 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43153 · Security Note
• https://docs.bell-sw.com/security/cves/CVE-2026-43153 · Note
• https://twitter.com/windowsforum/status/2052310317061865913 · Twitter Post
• https://git.kernel.org/linus/3a65ea768b8094e4699e72f9ab420eb9e0f3f568 · Note