CVE-2026-98543: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
In the Linux kernel, the following vulnerability has been resolved:
bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir
bpflsmhasdinodelocked() makes the verifier rewrite bpf[set|remove]dentryxattr() to the locked variants, which assume that the caller already holds the inode's irwsem. The pathunlink and pathrmdir hooks are listed, but securitypathunlink() and securitypathrmdir() run before vfsunlink()/vfsrmdir() take the victim inode's irwsem, so a sleepable BPF LSM program attached to either hook mutates the victim's xattrs without the lock held.
Drop the two path hooks from dinodelockedhooks so that the verifier keeps the locking bpf[set|remove]dentryxattr() variants, which take the lock themselves.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Drop the path_unlink and path_rmdir hooks from d_inode_locked_hooks so the verifier retains the locking bpf_[set|remove]_dentry_xattr() variants, which take the inode lock themselves.
Linux kernel BPF LSM d_inode_locked_hooks = exclude path_unlink and path_rmdir
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A sleepable BPF LSM program must be attached to the path_unlink or path_rmdir hook and use the BPF helpers that set or remove dentry extended attributes. The issue occurs because those hooks run before the victim inode's i_rwsem is taken.
Are systems without BPF LSM programs attached to these hooks affected?
The described unsafe xattr mutation path requires a sleepable BPF LSM program attached to path_unlink or path_rmdir. Systems not using such programs do not meet the stated trigger conditions.
What does the fix change?
The fix removes path_unlink and path_rmdir from the hooks treated as already holding the inode lock. This causes the verifier to retain the xattr helper variants that acquire the inode lock themselves.