CVE-2026-74400: bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix crash in bpf[set|remove]dentryxattr for negative dentries
bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passed (e.g. from securityinodecreate), dinode(dentry) returns NULL, and inodelock(inode) will cause a NULL pointer dereference.
Trivially fix this by adding a NULL check for inode before attempting to lock it, returning -EINVAL if it is NULL.
Additionally, drop WARNON(!inode) in bpfxattrreadpermission() and bpfxattrwritepermission(). These warnings could be triggered by passing a negative dentry to bpfgetdentryxattr() or the locked variants of the xattr kfuncs, potentially causing a Denial of Service on systems with paniconwarn enabled. Instead, simply return -EINVAL.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In bpf_xattr_read_permission(), add a NULL check for inode derived from the supplied dentry; if it is NULL (e.g., negative dentry), do not call inode_lock(inode) and instead simply return -EINVAL.
Linux kernel BPF kfuncs bpf_xattr_read_permission() handling of negative dentries = return -EINVAL when inode is NULL (instead of WARN_ON(!inode) / dereferencing NULL)