CVE-2026-43063
XFS Filesystem Use-After-Free in Linux Kernel
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's XFS filesystem code. Specifically, it involves the function xfs_attri_recover_work where a call to irele is made after a failed iget operation. The xlog_recovery_iget functions do not set the pointer @ip to a valid value if they return an error, which means that the irele function ends up dereferencing a dangling pointer. This can lead to undefined behavior or system instability.
How can this vulnerability impact me? :
The impact of this vulnerability could include system crashes or instability due to the dereferencing of invalid pointers in the kernel. This may lead to denial of service or potential corruption of filesystem data, affecting system reliability and availability.