PT-2026-37498 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-28 · CVE-2026-43158

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the XFS file system where incorrect freemap adjustments occur when adding extended attributes (xattrs) to leaf blocks. Specifically, when adding multiple xattrs, the entries array can grow and overlap with space already claimed by the freemap. This inconsistency can trigger an assertion failure in the leaf block freemap adjustment code, leading to a filesystem shutdown. The problem occurs within the xfs attr3 leaf add work() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2026:21706

ALSA-2026:21745

CVE-2026-43158

Affected Products

Linux Kernel

References · 59

• https://osv.dev/vulnerability/BELL-CVE-2026-43158 · Vendor Advisory
• https://git.kernel.org/stable/c/43f3b18679615a93bd848afde3602ba160637a46 · Patch
• https://git.kernel.org/stable/c/3eefc0c2b78444b64feeb3783c017d6adc3cd3ce · Patch
• https://git.kernel.org/stable/c/a396b3d73d51355e50acdb403ba9c4cae4c1174e · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43158 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43158 · Vendor Advisory
• https://git.kernel.org/stable/c/d08976725355b9d54d8332fce223fa281cc304a5 · Patch
• https://git.kernel.org/stable/c/ef42a8766ff3fdf51cf72fb36d0859c09d134478 · Patch
• https://osv.dev/vulnerability/ALSA-2026:21706 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-21706.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43158 · Vendor Advisory
• https://git.kernel.org/stable/c/6a8737afbccc340e718e0b22577312826390be8b · Patch
• https://git.kernel.org/stable/c/38613c01f69e1e77e6b8acab1e8ac665d01c2f15 · Patch
• https://git.kernel.org/stable/c/24ce71852f2cee6581e2cbebc15489ed52bf63b7 · Patch
• https://errata.almalinux.org/8/ALSA-2026-21745.html · Vendor Advisory