CVE-2026-43153 xfs: remove xfs_attr_leaf_hasname
A use-after-free vulnerability in the Linux kernel XFS filesystem allows attackers to potentially execute code or cause a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43153?
CVE-2026-43153 is a high-severity use after free vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: remove xfs_attr_leaf_hasname
The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values.
Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read.
Weakness: CWE-416
Which versions are affected by CVE-2026-43153?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43153?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-43153 being exploited?
There is no known exploitation of CVE-2026-43153 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-85845, BELL-CVE-2026-43153, DEBIAN-CVE-2026-43153, GHSA-j9jf-6fw4-2v2v, ROOT-OS-DEBIAN-11-CVE-2026-43153, ROOT-OS-DEBIAN-12-CVE-2026-43153 and 3 more.