CVE-2026-43474
- Source
- https://cve.org/CVERecord?id=CVE-2026-43474
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43474.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-43474
- Downstream
- Published
- 2026-05-08T14:22:32.871Z
- Modified
- 2026-07-15T01:49:18.837416672Z
- Summary
- fs: init flags_valid before calling vfs_fileattr_get
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
fs: init flagsvalid before calling vfsfileattr_get
syzbot reported a uninit-value bug in [1].
Similar to the "*get" context where the kernel's internal filekattr structure is initialized before calling vfsfileattr_get(), we should use the same mechanism when using fa.
[1] BUG: KMSAN: uninit-value in fusefileattrget+0xeb4/0x1450 fs/fuse/ioctl.c:517 fusefileattrget+0xeb4/0x1450 fs/fuse/ioctl.c:517 vfsfileattrget fs/file_attr.c:94 [inline] __dosysfilegetattr fs/fileattr.c:416 [inline]
Local variable fa.i created at: __dosysfilegetattr fs/fileattr.c:380 [inline] __sesysfilegetattr+0x8c/0xbd0 fs/fileattr.c:372
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43474.json" }- References
-
- https://git.kernel.org/stable/c/379e19e820dd1c6145426b97467728b3b89c0b42
- https://git.kernel.org/stable/c/b8c182b2c8c44c6016b11d8af61715ad7ef958a1
- https://git.kernel.org/stable/c/cb184dd19154fc486fa3d9e02afe70a97e54e055
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43474.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-43474
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git