CVE-2026-98543 (GCVE-0-2026-98543)

Vulnerability from cvelistv5 – Published: 2026-10-18 15:18 – Updated: 2026-10-24 14:09
VLAI
Title
bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir bpf_lsm_has_d_inode_locked() makes the verifier rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume that the caller already holds the inode's i_rwsem. The path_unlink and path_rmdir hooks are listed, but security_path_unlink() and security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the victim inode's i_rwsem, so a sleepable BPF LSM program attached to either hook mutates the victim's xattrs without the lock held. Drop the two path hooks from d_inode_locked_hooks so that the verifier keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take the lock themselves.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6639 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 56467292794b800164df20c076c409ac548e56ec , < 7504b677c4370c9e4b153c553ff8831c093b1ff6 (git)
Affected: 56467292794b800164df20c076c409ac548e56ec , < 640d37fbd34d03af727dbc567f48c0203d1de6b4 (git)
Affected: 56467292794b800164df20c076c409ac548e56ec , < 35d442ed1f86465e49df3119fb898f985186db13 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.55 , ≤ 6.18.* (semver)
Unaffected: 7.2.9 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/bpf_fs_kfuncs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7504b677c4370c9e4b153c553ff8831c093b1ff6",
              "status": "affected",
              "version": "56467292794b800164df20c076c409ac548e56ec",
              "versionType": "git"
            },
            {
              "lessThan": "640d37fbd34d03af727dbc567f48c0203d1de6b4",
              "status": "affected",
              "version": "56467292794b800164df20c076c409ac548e56ec",
              "versionType": "git"
            },
            {
              "lessThan": "35d442ed1f86465e49df3119fb898f985186db13",
              "status": "affected",
              "version": "56467292794b800164df20c076c409ac548e56ec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/bpf_fs_kfuncs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode\u0027s i_rwsem.  The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode\u0027s i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim\u0027s xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - unlink(2)/unlinkat(2)/rmdir(2) reach filename_unlinkat()/filename_rmdir() -\u003e security_path_unlink()/security_path_rmdir() -\u003e bpf_lsm_path_*(); vulnerable bpf_lsm_has_d_inode_locked() classification makes the verifier redirect bpf_[set|remove]_dentry_xattr() to _locked functions. The trigger enters locally, not via a protocol.\nAC:L - On UBIFS, one invocation deterministically fails ubifs_xattr_set()/ubifs_xattr_remove()\u0027s inode_is_locked() assertion; for races, the attacker can unlink two hardlinks in different parents concurrently, so separate parent locks do not serialize the same victim. No condition is outside the attacker\u0027s control.\nPR:L - bpf_prog_load() gates BPF_PROG_TYPE_LSM on bpf_token_capable(CAP_BPF) and CAP_PERFMON. A delegated bpffs token makes those ns_capable(token-\u003euserns, ...) checks, so a namespace-confined non-admin can load and attach the sleepable path hook; without delegation, init-namespace capabilities are required.\nUI:N - The attacker loads and attaches the BPF LSM program, then invokes unlinkat(2) or rmdir(2) on an object it can modify; no victim must mount media, open a file, or perform another action.\nS:C - With bpffs token delegation, a task confined to the token\u0027s user namespace can run the faulty BPF LSM program in the host kernel and force a shared host UBIFS read-only, crossing the container or sandbox availability boundary.\nC:N - Neither affected helper returns filesystem or kernel data: bpf_set_dentry_xattr_locked() only passes a verifier-bounded dynptr to __vfs_setxattr(), and the remove helper has no output. The missing i_rwsem is a mutation-ordering flaw, with no demonstrated OOB read, UAF, or disclosure path.\nI:L - btrfs_setxattr() explicitly relies on the inode lock to exclude a concurrent delete between its XATTR_REPLACE lookup and insert; this bug removes that exclusion, so concurrent path_unlink hooks can recreate or lose security.bpf.* metadata. Btrfs tree locking shows no arbitrary-memory-write primitive, limiting integrity impact.\nA:H - ubifs_xattr_set(..., check_lock=true) and ubifs_xattr_remove() assert inode_is_locked(); default ASSACT_RO calls ubifs_ro_mode(), sets SB_RDONLY, and denies later writes. One path hook calling the mis-selected _locked helper can therefore make a mounted UBIFS lose write availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:09:20.159Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7504b677c4370c9e4b153c553ff8831c093b1ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/640d37fbd34d03af727dbc567f48c0203d1de6b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/35d442ed1f86465e49df3119fb898f985186db13"
        }
      ],
      "title": "bpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98543",
    "datePublished": "2026-10-18T15:18:10.823Z",
    "dateReserved": "2026-09-25T10:25:14.356Z",
    "dateUpdated": "2026-10-24T14:09:20.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98543",
      "date": "2026-11-09",
      "epss": "0.00154",
      "percentile": "0.04538"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-21T18:39:17.000Z",
      "cve": "CVE-2026-98543",
      "id": "msrc_CVE-2026-98543",
      "initial_release_date": "2026-10-20T22:23:36.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98543.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/bpf_fs_kfuncs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7504b677c4370c9e4b153c553ff8831c093b1ff6",
                    "status": "affected",
                    "version": "56467292794b800164df20c076c409ac548e56ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "640d37fbd34d03af727dbc567f48c0203d1de6b4",
                    "status": "affected",
                    "version": "56467292794b800164df20c076c409ac548e56ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35d442ed1f86465e49df3119fb898f985186db13",
                    "status": "affected",
                    "version": "56467292794b800164df20c076c409ac548e56ec",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/bpf_fs_kfuncs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode\u0027s i_rwsem.  The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode\u0027s i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim\u0027s xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves."
          }
        ],
        "id": "CVE-2026-98543",
        "lastModified": "2026-10-24T14:16:46.803",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 4.7,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-18T16:17:06.200",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/35d442ed1f86465e49df3119fb898f985186db13"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/640d37fbd34d03af727dbc567f48c0203d1de6b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7504b677c4370c9e4b153c553ff8831c093b1ff6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-07T11:30:35+00:00",
      "cve": "CVE-2026-98543",
      "id": "CVE-2026-98543",
      "initial_release_date": "2026-10-18T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "202",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98543.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.