CVE-2026-98543

Received Received - Intake

Linux Kernel BPF Xattr Locking Bypass Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir bpf_lsm_has_d_inode_locked() makes the verifier rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume that the caller already holds the inode's i_rwsem. The path_unlink and path_rmdir hooks are listed, but security_path_unlink() and security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the victim inode's i_rwsem, so a sleepable BPF LSM program attached to either hook mutates the victim's xattrs without the lock held. Drop the two path hooks from d_inode_locked_hooks so that the verifier keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take the lock themselves.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98543

EUVD

EUVD-2026-103588

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	56467292794b800164df20c076c409ac548e56ec
Linux	Linux	56467292794b800164df20c076c409ac548e56ec
Linux	Linux	56467292794b800164df20c076c409ac548e56ec
Linux	Linux	6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in how extended attributes (xattrs) are handled during file deletion operations. The issue occurs because the BPF LSM (Linux Security Module) incorrectly assumes the inode is locked when modifying xattrs in path_unlink and path_rmdir hooks. This can lead to race conditions where xattrs are modified without proper locking, potentially causing security bypasses or data corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying if the vulnerable code paths are present in the running kernel. Commands like dmesg, journalctl -k, or checking /proc/kallsyms for BPF-related symbols may help. However, no direct detection commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to manipulate file extended attributes during deletion, potentially bypassing security policies or causing system instability. It primarily affects systems using BPF LSM programs that interact with file deletion hooks, leading to unauthorized access or data integrity issues.

Mitigation Strategies

Apply the latest kernel patches or updates that address this issue. If patches are unavailable, consider disabling BPF LSM programs temporarily or restricting their use until the fix is applied. Monitor kernel logs for signs of exploitation or unusual BPF-related activity.

Hi! I’m here to help you understand CVE-2026-98543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70