CVE-2026-43053

In the Linux kernel, the following vulnerability has been resolved:

xfs: close crash window in attr dabtree inactivation

When inactivating an inode with node-format extended attributes,

xfs_attr3_node_inactive() invalidates all child leaf/node blocks via

xfs_trans_binval(), but intentionally does not remove the corresponding

entries from their parent node blocks. The implicit assumption is that

xfs_attr_inactive() will truncate the entire attr fork to zero extents

afterwards, so log recovery will never reach the root node and follow

those stale pointers.

However, if a log shutdown occurs after the leaf/node block cancellations

commit but before the attr bmap truncation commits, this assumption

breaks. Recovery replays the attr bmap intact (the inode still has

attr fork extents), but suppresses replay of all cancelled leaf/node

blocks, maybe leaving them as stale data on disk. On the next mount,

xlog_recover_process_iunlinks() retries inactivation and attempts to

read the root node via the attr bmap. If the root node was not replayed,

reading the unreplayed root block triggers a metadata verification

failure immediately; if it was replayed, following its child pointers

to unreplayed child blocks triggers the same failure:

XFS (pmem0): Metadata corruption detected at

xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78

XFS (pmem0): Unmount and run xfs_repair

XFS (pmem0): First 128 bytes of corrupted metadata buffer:

00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

XFS (pmem0): metadata I/O error in "xfs_da_read_buf+0x104/0x190" at daddr 0x78 len 8 error 117

Fix this in two places:

In xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a

child block, immediately remove the entry that references it from the

parent node in the same transaction. This eliminates the window where

the parent holds a pointer to a cancelled block. Once all children are

removed, the now-empty root node is converted to a leaf block within the

same transaction. This node-to-leaf conversion is necessary for crash

safety. If the system shutdown after the empty node is written to the

log but before the second-phase bmap truncation commits, log recovery

will attempt to verify the root block on disk. xfs_da3_node_verify()

does not permit a node block with count == 0; such a block will fail

verification and trigger a metadata corruption shutdown. on the other

hand, leaf blocks are allowed to have this transient state.

In xfs_attr_inactive(), split the attr fork truncation into two explicit

phases. First, truncate all extents beyond the root block (the child

extents whose parent references have already been removed above).

Second, invalidate the root block and truncate the attr bmap to zero in

a single transaction. The two operations in the second phase must be

atomic: as long as the attr bmap has any non-zero length, recovery can

follow it to the root block, so the root block invalidation must commit

together with the bmap-to-zero truncation.