All vulnerabilities
CVE-2026-98543

Linux: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7504b677c4370c9e4b153c553ff8831c093b1ff6Also 640d37fbd34d03af727dbc567f48c0203d1de6b4, 35d442ed1f86465e49df3119fb898f985186db13CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7504b677c4370c9e4b153c553ff8831c093b1ff6LinuxCVE List
  • 640d37fbd34d03af727dbc567f48c0203d1de6b4LinuxCVE List
  • 35d442ed1f86465e49df3119fb898f985186db13LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

bpf_lsm_has_d_inode_locked() makes the verifier rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume that the caller already holds the inode's i_rwsem. The path_unlink and path_rmdir hooks are listed, but security_path_unlink() and security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the victim inode's i_rwsem, so a sleepable BPF LSM program attached to either hook mutates the victim's xattrs without the lock held.

Drop the two path hooks from d_inode_locked_hooks so that the verifier keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take the lock themselves.

Text from CVE List

Affected versions 8

  • Linuxaffected: 56467292794b800164df20c076c409ac548e56ec before 7504b677c4370c9e4b153c553ff8831c093b1ff6CVE List
  • Linuxaffected: 56467292794b800164df20c076c409ac548e56ec before 640d37fbd34d03af727dbc567f48c0203d1de6b4CVE List
  • Linuxaffected: 56467292794b800164df20c076c409ac548e56ec before 35d442ed1f86465e49df3119fb898f985186db13CVE List
  • Linuxaffected: 6.15CVE List
  • Linuxunaffected: all versions before 6.15CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3