# CVE-2026-43053: xfs: close crash window in attr dabtree inactivation CVE-2026-43053 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2026-43053, released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-43053 - Priority: Routine - CVSS: 5.5 (Moderate) - EPSS: 0.0012 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: May 1, 2026 - Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-43053 ## Description In the Linux kernel, the following vulnerability has been resolved: xfs: close crash window in attr dabtree inactivation When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the root node and follow those stale pointers. However, if a log shutdown occurs after the leaf/node block cancellations commit but before the attr bmap truncation commits, this assumption breaks. Recovery replays the attr bmap intact (the inode still has attr fork extents), but suppresses replay of all cancelled leaf/node blocks, maybe leaving them as stale data on disk. On the next mount, xlog_recover_process_iunlinks() retries inactivation and attempts to read the root node via the attr bmap. If the root node was not replayed, reading the unreplayed root block triggers a metadata verification failure immediately; if it was replayed, following its child pointers to unreplayed child blocks triggers the same failure: XFS (pmem0): Metadata corruption detected at xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78 XFS (pmem0): Unmount and run xfs_repair XFS (pmem0): First 128 bytes of corrupted metadata buffer: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ XFS (pmem0): metadata I/O error in "xfs_da_read_buf+0x104/0x190" at daddr 0x78 len 8 error 117 Fix this in two places: In xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a child block, immediately remove the entry that references it from the parent node in the same transaction. This eliminates the window where the parent holds a pointer to a cancelled block. Once all children are removed, the now-empty root node is converted to a leaf block within the same transaction. This node-to-leaf conversion is necessary for crash safety. If the system shutdown after the empty node is written to the log but before the second-phase bmap truncation commits, log recovery will attempt to verify the root block on disk. xfs_da3_node_verify() does not permit a node block with count == 0; such a block will fail verification and trigger a metadata corruption shutdown. on the other hand, leaf blocks are allowed to have this transient state. In xfs_attr_inactive(), split the attr fork truncation into two explicit phases. First, truncate all extents beyond the root block (the child extents whose parent references have already been removed above). Second, invalidate the root block and truncate the attr bmap to zero in a single transaction. The two operations in the second phase must be atomic: as long as the attr bmap has any non-zero length, recovery can follow it to the root block, so the root block invalidation must commit together with the bmap-to-zero truncation. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | dtb-aarch64 opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-64kb opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.66.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-64kb sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-azure opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.66.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-azure sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-default opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.66.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-default sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-default-base opensuse-leap 16.0 | 6.12.0-160000.36.1.160000.2.17 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.66.1.150700.17.39.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-default-base sles 16.0 | 6.12.0-160000.36.1.160000.2.17 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-docs opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.66.2 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-docs sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-kvmsmall opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-kvmsmall sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-livepatch-SLE15-SP7-RT_Update_17 sles 15.7 | 1-150700.1.3.1 | [SUSE-SU-2026:2799-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2799-1.md) | Jul 8, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_18 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-obs-build opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.66.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-obs-qa opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-obs-qa sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-rt opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-source opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.66.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-source sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-syms opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.66.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-syms sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-zfcpdump opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.66.1 | [SUSE-SU-2026:2800-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2800-1.md) | Jul 8, 2026 | | Linux | kernel-zfcpdump sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-43053](https://patchblox.com/security/data/fix/linux/debian-cve-2026-43053.md) | May 15, 2026 | | Linux | linux Debian 14 | 6.19.12-1 | [DEBIAN-CVE-2026-43053](https://patchblox.com/security/data/fix/linux/debian-cve-2026-43053.md) | May 15, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.