CVE-2026-74342: kernfs: link kn to its parent before the LSM init hook
In the Linux kernel, the following vulnerability has been resolved:
kernfs: link kn to its parent before the LSM init hook
After commit 12e9e3cd03b5 ("simpexattr: use per-sb cache"), kernfsxattrset() and kernfsxattrget() compute the cache via kernfsroot(kn) before any other check. kernfsroot(kn) walks kn->parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmemcachezalloc()'d kn. kn->parent was being set in kernfsnewnode() after kernfsnewnode() returned, and kn->dir.root is set even later by kernfscreatedirns() / kernfscreateemptydir().
The LSM kernfsinitsecurity hook is invoked from inside kernfsnewnode(), before either field has been initialized. selinuxkernfsinitsecurity() ends with kernfsxattrset(kn, XATTRNAMESELINUX, ...). kernfsroot(kn) then returns NULL, and &((struct kernfsroot )NULL)->xacache evaluates to offsetof(struct kernfsroot, xacache) which faults:
BUG: kernel NULL pointer dereference, address: 00000000000000e0 RIP: 0010:simplexattrset+0x27/0x8b0 Call Trace: kernfsxattrset+0x63/0xb0 selinuxkernfsinitsecurity+0x13b/0x270 securitykernfsinitsecurity+0x36/0xc0 kernfsnewnode+0x182/0x290 kernfsnewnode+0x80/0xc0 kernfscreatedirns+0x2b/0xa0 cgroupcreate+0x116/0x380 cgroupmkdir+0x7c/0x1a0
Reproduces deterministically at PID 1 (systemd) on an SELinux-enabled distro. The first cgroup mkdir under /sys/fs/cgroup with a labelled parent panics the kernel.
The LSM hook's contract is that the kndir argument is the parent of the new kn, so kn->parent should already point at kndir when the hook runs. Move kernfsget(parent) and rcuassignpointer of kn->parent from kernfsnewnode() into kernfsnewnode() right before the security hook, and unwind the parent reference on the errout4 path. kernfsroot(kn) then takes its parent branch during the hook and returns parent->dir.root, which is the correct root.
This also closes the same-shape latent bug in kernfsxattrget() (which today is hidden only by kernfsiattrsnoalloc() returning NULL on a fresh kn).