CVE-2026-43474

Vulnerability

CVE-2026-43474 is a Linux kernel vulnerability in the vfs_fileattr_get function, where the fa (file attributes) structure is used without being fully initialized. The kernel's internal file_kattr structure is properly initialized before calling vfs_fileattr_get(), but the fa structure used in the same code path is not, leading to an uninitialized value being passed to filesystem-specific get handlers like fuse_fileattr_get [1].

Exploitation

An attacker with local access and the ability to invoke the file_getattr system call (e.g., via ioctl on a FUSE filesystem) can trigger this bug. The uninitialized stack memory may contain sensitive kernel data, which can then be leaked to userspace through the returned file attributes structure. No special privileges beyond normal user access are required to trigger the code path [1].

Impact

Successful exploitation can result in information disclosure, as uninitialized kernel stack memory may be copied to userspace. This could leak sensitive data such as kernel pointers or other secrets, potentially aiding further attacks. The bug was discovered by syzbot, indicating it is reachable and can be triggered reliably [1].

Mitigation

The fix has been applied to the Linux kernel stable tree in commit b8c182b2c8c44c6016b11d8af61715ad7ef958a1, which initializes fa before calling vfs_fileattr_get. Users should update their kernels to include this patch. No workarounds are available; the vulnerability is fixed by the kernel update [1].