CVE-2026-43474

fs: init flags_valid before calling vfs_fileattr_get

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
4.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fs: init flags_valid before calling vfs_fileattr_get

syzbot reported a uninit-value bug in [1].

Similar to the "*get" context where the kernel's internal file_kattr

structure is initialized before calling vfs_fileattr_get(), we should

use the same mechanism when using fa.

[1]

BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517

fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517

vfs_fileattr_get fs/file_attr.c:94 [inline]

__do_sys_file_getattr fs/file_attr.c:416 [inline]

Local variable fa.i created at:

__do_sys_file_getattr fs/file_attr.c:380 [inline]

__se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00160 · 4.8th percentile
Published
2026-05-08T14:22Z
EPSS history
Timeline
  • 08 MAY 14:22Z
    fs: init flags_valid before calling vfs_fileattr_get
    cvelistv5