CVE-2026-43158

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix freemap adjustments when adding xattrs to leaf blocks

xfs/592 and xfs/794 both trip this assertion in the leaf block freemap

adjustment code after ~20 minutes of running on my test VMs:

ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)

+ xfs_attr3_leaf_hdr_size(leaf));

Upon enabling quite a lot more debugging code, I narrowed this down to

fsstress trying to set a local extended attribute with namelen=3 and

valuelen=71. This results in an entry size of 80 bytes.

At the start of xfs_attr3_leaf_add_work, the freemap looks like this:

i 0 base 448 size 0 rhs 448 count 46

i 1 base 388 size 132 rhs 448 count 46

i 2 base 2120 size 4 rhs 448 count 46

firstused = 520

where "rhs" is the first byte past the end of the leaf entry array.

This is inconsistent -- the entries array ends at byte 448, but

freemap[1] says there's free space starting at byte 388!

By the end of the function, the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References