{"id":"CVE-2026-98543","published":"2026-10-18T16:17:06.200","lastModified":"2026-10-19T10:19:10.220","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode's i_rwsem.  The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode's i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim's xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/35d442ed1f86465e49df3119fb898f985186db13","tags":[]},{"url":"https://git.kernel.org/stable/c/640d37fbd34d03af727dbc567f48c0203d1de6b4","tags":[]},{"url":"https://git.kernel.org/stable/c/7504b677c4370c9e4b153c553ff8831c093b1ff6","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}