Medium 5.5Published May 8, 2026

CVE-2026-43474fs: init flags_valid before calling vfs_fileattr_get

Updated under an hour ago (Oct 27, 2026, 11:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fs: init flags_valid before calling vfs_fileattr_get syzbot reported a uninit-value bug in [1]. Similar to the "*get" context where the kernel's internal file_kattr structure is initialized before calling vfs_fileattr_get(), we should use the same mechanism when using fa. [1] BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 vfs_fileattr_get fs/file_attr.c:94 [inline] __do_sys_file_getattr fs/file_attr.c:416 [inline] Local variable fa.i created at: __do_sys_file_getattr fs/file_attr.c:380 [inline] __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from be7efb2d20d67f334a7de2aef77ae6c69367e646 before 379e19e820dd1c6145426b97467728b3b89c0b42; from be7efb2d20d67f334a7de2aef77ae6c69367e646 before b8c182b2c8c44c6016b11d8af61715ad7ef958a1; from be7efb2d20d67f334a7de2aef77ae6c69367e646 before cb184dd19154fc486fa3d9e02afe70a97e54e055	CNA record
linux linux_kernel linux:linux_kernel	from 6.17 before 6.18.19; from 6.19 before 6.19.9; 7.0	NVD

References

References

https://git.kernel.org/stable/c/379e19e820dd1c6145426b97467728b3b89c0b42	patch
https://git.kernel.org/stable/c/b8c182b2c8c44c6016b11d8af61715ad7ef958a1	patch
https://git.kernel.org/stable/c/cb184dd19154fc486fa3d9e02afe70a97e54e055	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.