Riskcovery

CVE-2026-43474

fs: init flags_valid before calling vfs_fileattr_get

State
Published
Severity
Not scored
Published
May 8, 2026
Updated
May 11, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: init flags_valid before calling vfs_fileattr_get

syzbot reported a uninit-value bug in [1].

Similar to the "*get" context where the kernel's internal file_kattr structure is initialized before calling vfs_fileattr_get(), we should use the same mechanism when using fa.

[1] BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 vfs_fileattr_get fs/file_attr.c:94 [inline] __do_sys_file_getattr fs/file_attr.c:416 [inline]

Local variable fa.i created at: __do_sys_file_getattr fs/file_attr.c:380 [inline] __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • be7efb2d20d67f334a7de2aef77ae6c69367e646 to before 379e19e820dd1c6145426b97467728b3b89c0b42Affected
  • be7efb2d20d67f334a7de2aef77ae6c69367e646 to before b8c182b2c8c44c6016b11d8af61715ad7ef958a1Affected
  • be7efb2d20d67f334a7de2aef77ae6c69367e646 to before cb184dd19154fc486fa3d9e02afe70a97e54e055Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.19 through 6.18.*Not affected
  • 6.19.9 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.