CVE-2026-43474 Details
Description
In the Linux kernel, the following vulnerability has been resolved: fs: init flags_valid before calling vfs_fileattr_get syzbot reported a uninit-value bug in [1]. Similar to the "*get" context where the kernel's internal file_kattr structure is initialized before calling vfs_fileattr_get(), we should use the same mechanism when using fa. [1] BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 vfs_fileattr_get fs/file_attr.c:94 [inline] __do_sys_file_getattr fs/file_attr.c:416 [inline] Local variable fa.i created at: __do_sys_file_getattr fs/file_attr.c:380 [inline] __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372
A vulnerability has been identified in the Linux kernel related to uninitialized variable handling in the file attribute management system. This issue occurs in the stable branch of the Linux kernel. The problem arises because the internal 'file_kattr' structure is not properly initialized before being used, which can lead to the use of undefined values. The vulnerability was reported by syzbot, highlighting that the 'flags_valid' field of the 'file_kattr' structure should be set to true before calling the 'vfs_fileattr_get' function. This oversight can cause inconsistencies in file attribute retrieval, potentially leading to unexpected behavior in file management operations.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/379e19e820dd1c6145426b97467728b3b89c0b42 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b8c182b2c8c44c6016b11d8af61715ad7ef958a1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cb184dd19154fc486fa3d9e02afe70a97e54e055 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.17, < 6.18.19 >= 6.19, < 6.19.9 7.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 21, 2026 | Reanalysis | [email protected] |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | kernel.org |