CVE-2026-43474

What it actually does

This is a local Linux kernel flaw in file-attribute handling. A kernel structure used during file attribute retrieval is not fully initialized before being passed into vfs_fileattr_get(), with the reported path involving FUSE file attribute handling. A low-privileged local user may be able to trigger use of uninitialized kernel data through file attribute retrieval operations, potentially causing a kernel warning, oops, panic, or system crash. The assessed impact is primarily availability; there is no clear indication from the provided data of confidentiality loss, privilege escalation, or data tampering.

Why it matters to the business

Successful exploitation can disrupt Linux systems by crashing or destabilizing the kernel, causing service outages, failed workloads, or forced reboots. The risk is highest on shared Linux servers, developer workstations, build hosts, container platforms, and systems where untrusted local users or workloads can execute filesystem operations. This issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, has very low EPSS, and has no reported exploit maturity, so immediate internet-scale exploitation is unlikely; however, local denial-of-service flaws still matter for multi-tenant or high-availability environments.

How an attack unfolds

An attacker first needs local code execution with low privileges on a vulnerable Linux system. They then exercise file attribute retrieval paths, especially those involving FUSE-backed filesystems, in a way that reaches vfs_fileattr_get() before the relevant file attribute structure field has been initialized. Because the kernel consumes uninitialized state, the operation may result in undefined behavior visible as a KMSAN report, kernel oops, panic, or crash. The practical outcome is denial of service rather than remote compromise.

How to fix it

Apply the Linux kernel update from the relevant distribution or vendor that includes the fix initializing the file attribute validity field before vfs_fileattr_get() is called. Because no exact fixed package versions were provided, track vendor advisories for the deployed kernel branches and upgrade to the first fixed kernel or later. Reboot into the patched kernel, or use an approved live patch if the vendor provides one and it covers this issue. As interim risk reduction, limit local shell access to trusted users, restrict the ability of untrusted users or workloads to create/use FUSE mounts where operationally feasible, harden multi-tenant hosts, and monitor for kernel oops/panic events related to file attribute or FUSE handling.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, includes the vendor fix. Validate with `uname -r`, package manager metadata, and vendor changelogs or commit references for the file attribute initialization fix. After patching, reboot or verify live-patch activation. On test systems, exercise normal file attribute operations on local and FUSE-backed filesystems and confirm no KMSAN, oops, panic, or FUSE file attribute errors appear in kernel logs. For exposure checks, inventory Linux kernel versions across fleets and compare them against vendor-fixed releases for this issue.

Typical attack path

1. Obtain local shell access or run code as an unprivileged user on a vulnerable Linux host.
2. Create, access, or interact with filesystem objects that route file attribute queries through the vulnerable kernel path, such as FUSE-related file attribute handling.
3. Trigger file attribute retrieval operations repeatedly or under controlled conditions.
4. Cause the kernel to consume an uninitialized field during vfs_fileattr_get() processing.
5. Induce kernel instability, oops, panic, or reboot, resulting in local denial of service.

How to detect it

Look for evidence of kernel instability or crash reports involving FUSE file attribute handling and vfs_fileattr_get(). Relevant sources include `dmesg`, `journalctl -k`, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, kernel crash dumps, kdump/vmcore artifacts, systemd journal entries, and endpoint telemetry that records kernel oops or panic events. Search for repeated local activity shortly before crashes involving file attribute queries, FUSE mounts, or utilities that retrieve file flags/attributes. KMSAN-specific messages are most likely on instrumented/debug kernels and may not appear on production builds; on production systems, evidence may be limited to oops, panic, watchdog reset, or unexplained reboot entries referencing nearby kernel symbols. No named threat actors or ransomware campaigns are associated with this issue in the provided data.

• BUG: KMSAN: uninit-value
• fuse_fileattr_get
• vfs_fileattr_get
• __do_sys_file_getattr
• __se_sys_file_getattr
• fs/fuse/ioctl.c:517
• fs/file_attr.c:94
• fs/file_attr.c:416
• fs/file_attr.c:380
• kernel BUG
• Oops:
• Kernel panic
• general protection fault
• watchdog: BUG: soft lockup
• watchdog: BUG: hard LOCKUP

What your security team should do

• Prioritize patching shared, multi-user, developer, CI/CD, container-host, and high-availability Linux systems where local denial of service has elevated business impact.
• Inventory affected Linux kernel versions and map them to vendor advisories, because upstream and distribution fixed versions may differ.
• Apply the fixed kernel and verify systems have actually booted into it; installed-but-not-running kernel updates do not remediate the issue.
• Where patching is delayed, reduce local attack surface by limiting untrusted shell access and restricting unprivileged FUSE usage where feasible.
• Add monitoring for kernel oops, panic, KMSAN, and FUSE file attribute errors to identify possible exploitation or regression symptoms.
• Treat repeated local kernel crashes involving FUSE or file attribute retrieval as suspicious on shared systems, even though public exploitation is not currently reported.