UBUNTU-CVE-2026-98543: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked() makes the verifier rewrite bpf[set|remove]dentryxattr() to the locked variants, which assume that the caller already holds the inode's irwsem. The pathunlink and pathrmdir hooks are listed, but securitypathunlink() and securitypathrmdir() run before vfsunlink()/vfsrmdir() take the victim inode's irwsem, so a sleepable BPF LSM program attached to either hook mutates the victim's xattrs without the lock held. Drop the two path hooks from dinodelockedhooks so that the verifier keeps the locking bpf[set|remove]dentryxattr() variants, which take the lock themselves.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the path_unlink and path_rmdir hooks from d_inode_locked_hooks so the verifier retains the bpf_[set|remove]_dentry_xattr() variants that acquire the inode lock themselves.
Linux kernel BPF LSM d_inode_locked_hooks = Exclude path_unlink and path_rmdir