CVE-2026-43187

What it actually does

This vulnerability is a Linux kernel XFS filesystem metadata corruption flaw in extended attribute handling. Repeated extended attribute updates can leave inconsistent XFS attribute leaf free-space map entries, including zero-length entries with stale nonzero base offsets. Later attribute insertions may allocate new extended attribute name/value data over existing attribute entries, corrupting filesystem metadata or file-associated extended attributes. The practical technical impact is loss of integrity and availability of data stored on XFS filesystems, with possible confidentiality impact if corrupted metadata causes unintended exposure or misassociation of file attributes. Exploitation requires the ability to perform filesystem operations that create or modify extended attributes on an affected XFS filesystem; the CVSS vector indicates low-complexity exploitation with low privileges and no user interaction.

Why it matters to the business

Successful exploitation can cause data corruption, application errors, failed backups, service outages, or costly filesystem recovery work on systems using XFS. Because XFS is commonly used on Linux servers, storage nodes, virtualization hosts, container platforms, and databases, operational impact can be significant even if exploitation is not currently known to be widespread. The vulnerability is not listed in CISA KEV, is not currently associated with ransomware use, and has a low, flat EPSS score, which suggests no broad active exploitation signal at this time; however, the high CVSS score and potential for data loss make remediation important for systems where untrusted or semi-trusted users, workloads, containers, or services can write extended attributes on XFS-backed storage.

How an attack unfolds

An attacker first obtains the ability to run code or perform file operations as a low-privileged user or workload on a Linux system that uses an affected kernel and an XFS filesystem. The attacker then creates or selects files on that filesystem and repeatedly adds, expands, removes, or modifies extended attributes in a pattern that exercises XFS attribute leaf block allocation and free-space map updates. Due to the kernel bug, a zero-length free-space map entry can retain a stale base value and later collide with another entry tracking actual free space. A subsequent extended attribute insertion may then be placed over part of the existing attribute entry array. The result is filesystem metadata or extended attribute corruption, which can cause data loss, application malfunction, integrity failures, kernel/XFS error reporting, remounts with errors, or administrative recovery operations such as xfs_repair. No public exploit maturity was provided, and the issue is not currently marked as known exploited.

How to fix it

Upgrade affected Linux kernels to a vendor release that includes the upstream XFS fix for deleting or zeroing empty attribute leaf free-space map entries. Because no exact fixed versions were provided in the input, use the fixed kernel versions published by the relevant Linux distribution, appliance vendor, cloud image provider, or kernel maintainer. Prioritize systems that mount XFS filesystems read-write and allow untrusted users, tenants, containers, CI jobs, batch workloads, or network-facing services to write files or extended attributes. Where immediate patching is not possible, reduce exposure by restricting local shell access, limiting untrusted workloads on XFS-backed storage, applying container and namespace isolation, enforcing least privilege on services that can write to XFS filesystems, and disabling or constraining application features that permit arbitrary extended attribute manipulation where feasible. Ensure reliable backups exist before patching or repairing filesystems, and schedule filesystem checks or xfs_repair only according to vendor guidance and with filesystems unmounted or otherwise safely offline.

How to confirm the fix worked

Confirm remediation by verifying that running kernels match distribution or vendor advisories containing the XFS attr leaf freemap fix. Inventory mounted filesystems with tools such as findmnt, mount, or lsblk -f to identify XFS usage, then correlate each host or image with its kernel package version and vendor security bulletin. Validate that systems have been rebooted into the updated kernel, not merely that packages were installed. Review kernel logs after patching for recurring XFS corruption messages. For high-value filesystems, perform vendor-approved consistency checks, backup verification, and controlled xfs_repair validation during maintenance windows. To confirm exposure reduction, verify that untrusted users or workloads cannot write extended attributes to sensitive XFS-backed paths unless required.

Typical attack path

1. Identify or gain access to a Linux system running an affected kernel with one or more XFS filesystems mounted read-write.
2. Obtain low-privileged local execution or access through a service, container, batch job, shell account, or application path that can create files and set extended attributes on the XFS filesystem.
3. Create or manipulate files with extended attributes using repeated setxattr-style operations that grow the XFS attribute entries array.
4. Trigger the XFS attribute leaf free-space map inconsistency involving zero-length entries with stale base offsets.
5. Perform additional extended attribute additions until XFS allocates new attribute data over existing attribute entries.
6. Cause filesystem metadata or extended attribute corruption, leading to data loss, application failures, integrity errors, or service disruption.
7. Rely on the resulting corruption to create operational impact or obscure prior activity, depending on attacker objectives.

How to detect it

Detection should focus on evidence of XFS corruption and suspicious extended attribute manipulation rather than a single network indicator. Review kernel logs, systemd journal, syslog, audit logs, EDR telemetry, container runtime logs, and filesystem maintenance records. Look for XFS metadata corruption messages, attribute leaf block errors, forced shutdowns, remounts read-only, repeated xfs_repair activity, unexplained application errors reading files, or sudden backup verification failures on XFS-backed volumes. If Linux auditd or EDR file telemetry is available, search for unusually high-volume or repetitive setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, or fremovexattr syscalls by low-privileged users, service accounts, or containerized processes. Correlate these events with affected kernel versions and XFS mount points. Because no public exploit maturity, threat actor attribution, or KEV exploitation signal was provided, absence of known IOC hits does not prove absence of attempted exploitation; prioritize behavioral anomalies and filesystem integrity evidence.

• XFS: Metadata corruption detected
• XFS: Internal error
• XFS: Filesystem has been shut down
• XFS: log mount/recovery failed
• XFS: Corruption detected
• XFS: metadata I/O error
• Structure needs cleaning
• EFSCORRUPTED
• xfs_attr_leaf
• xfs_attr3_leaf
• xfs_attr_leaf_add
• xfs_attr3_leaf_add
• setxattr
• lsetxattr
• fsetxattr
• removexattr
• lremovexattr
• fremovexattr
• xfs_repair
• /usr/sbin/xfs_repair
• /sbin/xfs_repair

What your security team should do

• Inventory Linux systems using XFS filesystems and rank them by whether untrusted users, containers, services, or applications can write files or extended attributes.
• Patch affected kernels using vendor-provided updates and reboot into the fixed kernel; prioritize multi-user servers, container hosts, storage platforms, and externally reachable services using XFS-backed storage.
• Monitor kernel, system journal, and filesystem logs for XFS metadata corruption, extended attribute errors, forced shutdowns, remounts, or repair activity.
• Verify backup integrity for important XFS-backed data before and after remediation, because the primary risk is data corruption or loss.
• Restrict low-privileged local access and reduce write permissions to XFS-backed locations where arbitrary extended attribute manipulation is not necessary.
• Review container and workload isolation controls to limit the ability of compromised workloads to manipulate host or shared XFS filesystems.
• Do not treat the low EPSS and non-KEV status as a reason to ignore the issue on critical storage systems; use them to sequence remediation after actively exploited internet-facing vulnerabilities where appropriate.
• After patching, confirm that systems have rebooted into the corrected kernel and that old vulnerable kernels are not still running.