SB20261022119 - Improper locking in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Improper locking (CVE-ID: CVE-2026-98543)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger unsynchronized extended attribute updates that may cause inconsistent filesystem metadata.

The vulnerability exists due to improper locking in the Linux kernel BPF LSM verifier when processing extended attribute operations in sleepable programs attached to the path_unlink or path_rmdir hook. A local privileged user can trigger these hooks with a program that calls bpf_set_dentry_xattr() or bpf_remove_dentry_xattr() to modify the victim inode's extended attributes without holding its i_rwsem lock, potentially causing inconsistent metadata during concurrent operations.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/35d442ed1f86465e49df3119fb898f985186db13
• https://git.kernel.org/stable/c/640d37fbd34d03af727dbc567f48c0203d1de6b4
• https://git.kernel.org/stable/c/7504b677c4370c9e4b153c553ff8831c093b1ff6