CyberSecBulletin
CVE-2026-43187NVD status: Modified

Linux: Integer Underflow (Wrap or Wraparound)

Published Updated By the CyberSecBulletin desk

CVE-2026-43187 is a high-severity integer underflow (wrap or wraparound) vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions f3c0d1fc1eadbb4adbee5ab7757d41d35f48325b, aa9083d97e2157da3c6fb45ddb1a97af7f188f7f, a631899025d47ea1aa6464d76db5b4d3b6d196fd as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.47% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to f3c0d1fc1eadbb4adbee5ab7757d41d35f48325b or aa9083d97e2157da3c6fb45ddb1a97af7f188f7f or a631899025d47ea1aa6464d76db5b4d3b6d196fd or ffaf5c99d0f862db021fb1af8b813c1416b1beb2, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.252 or 5.15.202 or 6.1.165 or 6.6.128, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, f3c0d1fc1eadbb4adbee5ab7757d41d35f48325b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, aa9083d97e2157da3c6fb45ddb1a97af7f188f7f; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, a631899025d47ea1aa6464d76db5b4d3b6d196fd; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, ffaf5c99d0f862db021fb1af8b813c1416b1beb2; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, e1b8c6452ee99a30e188a88f3f3f804fb1c6004a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, f31a8334e1c54b126fcecf98645a49b6bc5ad399; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 479b05fc3ee272090f671b06a41f3da8aa78eece; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 6f13c1d2a6271c2e73226864a0e83de2770b6f34; and 1 more rangesf3c0d1fc1eadbb4adbee5ab7757d41d35f48325b, aa9083d97e2157da3c6fb45ddb1a97af7f188f7f, a631899025d47ea1aa6464d76db5b4d3b6d196fd, ffaf5c99d0f862db021fb1af8b813c1416b1beb2, e1b8c6452ee99a30e188a88f3f3f804fb1c6004a, f31a8334e1c54b126fcecf98645a49b6bc5ad399
LinuxLinux Kernel2.6.12.1 up to, but not including, 5.10.252; 5.11 up to, but not including, 5.15.202; 5.16 up to, but not including, 6.1.165; 6.2 up to, but not including, 6.6.128; 6.7 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; 6.19 up to, but not including, 6.19.6; 2.6.125.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: xfs: delete attr leaf freemap entries when empty Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow"), Brian Foster observed that it's possible for a small freemap at the end of the end of the xattr entries array to experience a size underflow when subtracting the space consumed by an expansion of the entries array. There are only three freemap entries, which means that it is not a complete index of all free space in the leaf block. This code can leave behind a zero-length freemap entry with a nonzero base. Subsequent setxattr operations can increase the base up to the point that it overlaps with another freemap entry. This isn't in and of itself a problem because the code in _leaf_add that finds free space ignores any freemap entry with zero size. However, there's another bug in the freemap update code in _leaf_add, which is that it fails to update a freemap entry that begins midway through the xattr entry that was just appended to the array. That can result in the freemap containing two entries with the same base but different sizes (0 for the "pushed-up" entry, nonzero for the entry that's actually tracking free space). A subsequent _leaf_add can then allocate xattr namevalue entries on top of the entries array, leading to data loss. But fixing that is for later. For now, eliminate the possibility of confusion by zeroing out the base of any freemap entry that has zero size. Because the freemap is not intended to be a complete index of free space, a subsequent failure to find any free space for a new xattr will trigger block compaction, which regenerates the freemap. It looks like this bug has been in the codebase for quite a long time.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

More Integer Underflow (Wrap or Wraparound) vulnerabilities (CWE-191)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Integer Underflow (Wrap or Wraparound) vulnerabilities

Spotted an error? Tell us.