PT-2026-39135 · Linux · Linux Kernel

Syzbot · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-43474

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An uninitialized value bug exists where flags valid is not initialized before the vfs fileattr get() function is called. This issue occurs because the fa variable is not handled with the same initialization mechanism as the internal file kattr structure, potentially leading to instability in filesystem handlers, including those used in WSL and Azure containers. The issue was identified via a KMSAN report involving the fuse fileattr get() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2026-43474

Affected Products

Linux Kernel

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43474 · Vendor Advisory
• https://git.kernel.org/stable/c/379e19e820dd1c6145426b97467728b3b89c0b42 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43474 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43474 · Vendor Advisory
• https://git.kernel.org/stable/c/b8c182b2c8c44c6016b11d8af61715ad7ef958a1 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43474 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43474 · Security Note
• https://git.kernel.org/stable/c/cb184dd19154fc486fa3d9e02afe70a97e54e055 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43474 · Security Note
• https://t.me/cveNotify/164383 · Telegram Post
• https://twitter.com/CVEnew/status/2052767585163501723 · Twitter Post
• https://twitter.com/windowsforum/status/2053763393832521891 · Twitter Post
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://t.me/CVEtracker/53122 · Telegram Post