CVE-2026-43053

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfs: close crash window in attr dabtree inactivation

When inactivating an inode with node-format extended attributes,

xfs_attr3_node_inactive() invalidates all child leaf/node blocks via

xfs_trans_binval(), but intentionally does not remove the corresponding

entries from their parent node blocks. The implicit assumption is that

xfs_attr_inactive() will truncate the entire attr fork to zero extents

afterwards, so log recovery will never reach the root node and follow

those stale pointers.

However, if a log shutdown occurs after the leaf/node block cancellations

commit but before the attr bmap truncation commits, this assumption

breaks. Recovery replays the attr bmap intact (the inode still has

attr fork extents), but suppresses replay of all cancelled leaf/node

blocks, maybe leaving them as stale data on disk. On the next mount,

xlog_recover_process_iunlinks() retries inactivation and attempts to

read the root nod

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References