CVE-2026-43053
Awaiting Analysis Awaiting Analysis - Queue
XFS Metadata Corruption in Linux Kernel

Publication date: 2026-05-01

Last updated on: 2026-05-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: close crash window in attr dabtree inactivation When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the root node and follow those stale pointers. However, if a log shutdown occurs after the leaf/node block cancellations commit but before the attr bmap truncation commits, this assumption breaks. Recovery replays the attr bmap intact (the inode still has attr fork extents), but suppresses replay of all cancelled leaf/node blocks, maybe leaving them as stale data on disk. On the next mount, xlog_recover_process_iunlinks() retries inactivation and attempts to read the root node via the attr bmap. If the root node was not replayed, reading the unreplayed root block triggers a metadata verification failure immediately; if it was replayed, following its child pointers to unreplayed child blocks triggers the same failure: XFS (pmem0): Metadata corruption detected at xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78 XFS (pmem0): Unmount and run xfs_repair XFS (pmem0): First 128 bytes of corrupted metadata buffer: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ XFS (pmem0): metadata I/O error in "xfs_da_read_buf+0x104/0x190" at daddr 0x78 len 8 error 117 Fix this in two places: In xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a child block, immediately remove the entry that references it from the parent node in the same transaction. This eliminates the window where the parent holds a pointer to a cancelled block. Once all children are removed, the now-empty root node is converted to a leaf block within the same transaction. This node-to-leaf conversion is necessary for crash safety. If the system shutdown after the empty node is written to the log but before the second-phase bmap truncation commits, log recovery will attempt to verify the root block on disk. xfs_da3_node_verify() does not permit a node block with count == 0; such a block will fail verification and trigger a metadata corruption shutdown. on the other hand, leaf blocks are allowed to have this transient state. In xfs_attr_inactive(), split the attr fork truncation into two explicit phases. First, truncate all extents beyond the root block (the child extents whose parent references have already been removed above). Second, invalidate the root block and truncate the attr bmap to zero in a single transaction. The two operations in the second phase must be atomic: as long as the attr bmap has any non-zero length, recovery can follow it to the root block, so the root block invalidation must commit together with the bmap-to-zero truncation.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-01
Generated
2026-05-07
AI Q&A
2026-05-01
EPSS Evaluated
2026-05-05
NVD
CVE-2026-43053
EUVD
EUVD-2026-26652
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's XFS filesystem, specifically in the handling of extended attributes with node-format inodes. When inactivating such an inode, the system invalidates child leaf/node blocks but does not immediately remove their references from parent nodes, assuming a later truncation will clear them. However, if a system shutdown occurs between these steps, stale pointers to cancelled blocks can remain on disk.

During recovery after such a shutdown, the system may encounter these stale pointers, leading to metadata verification failures and potential corruption errors. This can cause the filesystem to detect corruption and require repair.

The fix involves removing references to cancelled child blocks immediately within the same transaction and splitting the attribute fork truncation into two atomic phases to ensure consistency and prevent stale pointers from persisting.


How can this vulnerability impact me? :

This vulnerability can lead to metadata corruption in the XFS filesystem, causing the filesystem to detect errors during mount or recovery.

As a result, the system may unmount the affected filesystem and require running repair tools like xfs_repair to fix the corruption.

This can cause system downtime, potential data inaccessibility, and increased maintenance efforts.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability manifests as metadata corruption errors related to the XFS filesystem, specifically during inode inactivation with node-format extended attributes.

Detection can be done by monitoring system logs for error messages similar to the following:

  • XFS (pmem0): Metadata corruption detected at xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78
  • XFS (pmem0): Unmount and run xfs_repair
  • XFS (pmem0): metadata I/O error in "xfs_da_read_buf+0x104/0x190" at daddr 0x78 len 8 error 117

To check for these errors, you can use commands such as:

  • journalctl -k | grep -i xfs
  • dmesg | grep -i xfs
  • grep -i xfs /var/log/syslog

Additionally, running the filesystem check tool xfs_repair on the affected filesystem can help detect and potentially fix metadata corruption.


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include:

  • Unmount the affected XFS filesystem as soon as possible to prevent further corruption.
  • Run the xfs_repair utility on the affected filesystem to detect and repair metadata corruption.
  • Avoid system shutdowns or reboots during active inode inactivation processes to reduce the risk of triggering the vulnerability.
  • Apply the patch or update the Linux kernel to the fixed version that addresses this vulnerability, which includes changes to xfs_attr3_node_inactive() and xfs_attr_inactive() functions to ensure atomic removal of stale pointers and proper attr fork truncation.

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The provided CVE description does not include any information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart