CyberSecBulletin
CVE-2026-43365NVD status: Modified

In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized…

Published Updated By the CyberSecBulletin desk

CVE-2026-43365 is a high-severity improper input validation vulnerability in Linux, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 5afae524f83d6a18517298491a5624cb0eae5029, 2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40, 41e91dff2d3974730b5ee50daa8e27ec254cbf91 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.51% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 5afae524f83d6a18517298491a5624cb0eae5029 or 2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40 or 41e91dff2d3974730b5ee50daa8e27ec254cbf91 or e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.203 or 6.1.167 or 6.6.130 or 6.12.78, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxa6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48 up to, but not including, 5afae524f83d6a18517298491a5624cb0eae5029; a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48 up to, but not including, 2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40; a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48 up to, but not including, 41e91dff2d3974730b5ee50daa8e27ec254cbf91; a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48 up to, but not including, e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d; a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48 up to, but not including, 446a1f5bb64ba38adb93cb043ff0f7b85e8937ca; a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48 up to, but not including, 5e7148402dfc4a5b7894d8e97b15e5c2e70924aa; a6a65fef5ef8d0a6a0ce514eb66b2f3dfa777b48 up to, but not including, 52a8a1ba883defbfe3200baa22cf4cd21985d51a; 5.145afae524f83d6a18517298491a5624cb0eae5029, 2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40, 41e91dff2d3974730b5ee50daa8e27ec254cbf91, e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d, 446a1f5bb64ba38adb93cb043ff0f7b85e8937ca, 5e7148402dfc4a5b7894d8e97b15e5c2e70924aa
LinuxLinux Kernel5.14 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.19; 6.19 up to, but not including, 6.19.9; 7.05.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
LowLimited modification of data is possible.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized l_iclog_roundoff values If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k physical sectors... XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197. XFS (sda1): failed to locate log tail XFS (sda1): log mount/recovery failed: error -74 XFS (sda1): log mount failed XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Ending clean mount ...on the current xfsprogs for-next which has a broken mkfs. xfs_info shows this... meta-data=/dev/sda1 isize=512 agcount=4, agsize=644992 blks = sectsz=4096 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 = exchange=1 metadir=1 data = bsize=4096 blocks=2579968, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=1 log =internal log bsize=4096 blocks=16384, version=2 = sectsz=4096 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 = rgcount=0 rgsize=268435456 extents = zoned=0 start=0 reserved=0 ...observe that the log section has sectsz=4096 sunit=0, which means that the roundoff factor is 512, not 4096 as you'd expect. We should fix mkfs not to generate broken filesystems, but anyone can fuzz the ondisk superblock so we should be more cautious. I think the inadequate logic predates commit a6a65fef5ef8d0, but that's clearly going to require a different backport.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

How developers prevent this class of flaw

  • Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build recognizers for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses.
  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

More Improper Input Validation vulnerabilities (CWE-20)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Input Validation vulnerabilities

Spotted an error? Tell us.