CVE-2026-98543
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir bpf_lsm_has_d_inode_locked() makes the verifier rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume that the caller already holds the inode's i_rwsem. The path_unlink and path_rmdir hooks are listed, but security_path_unlink() and security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the victim inode's i_rwsem, so a sleepable BPF LSM program attached to either hook mutates the victim's xattrs without the lock held. Drop the two path hooks from d_inode_locked_hooks so that the verifier keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take the lock themselves.
How to fix
- Linux Linux7504b677c4370c9e4b153c553ff8831c093b1ff6, 640d37fbd34d03af727dbc567f48c0203d1de6b4, 35d442ed1f86465e49df3119fb898f985186db13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 56467292794b800164df20c076c409ac548e56ec ≤ v < 7504b677c4370c9e4b153c553ff8831c093b1ff6, 56467292794b800164df20c076c409ac548e56ec ≤ v < 640d37fbd34d03af727dbc567f48c0203d1de6b4, 56467292794b800164df20c076c409ac548e56ec ≤ v < 35d442ed1f86465e49df3119fb898f985186db13, 6.15 | 7504b677c4370c9e4b153c553ff8831c093b1ff6, 640d37fbd34d03af727dbc567f48c0203d1de6b4, 35d442ed1f86465e49df3119fb898f985186db13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.