Improper locking in Linux kernel - CVE-2026-98543

Vulnerability details

The vulnerability allows a local privileged user to trigger unsynchronized extended attribute updates that may cause inconsistent filesystem metadata.

The vulnerability exists due to improper locking in the Linux kernel BPF LSM verifier when processing extended attribute operations in sleepable programs attached to the path_unlink or path_rmdir hook. A local privileged user can trigger these hooks with a program that calls bpf_set_dentry_xattr() or bpf_remove_dentry_xattr() to modify the victim inode's extended attributes without holding its i_rwsem lock, potentially causing inconsistent metadata during concurrent operations.

Affected software

How to mitigate CVE-2026-98543

External References

• https://git.kernel.org/stable/c/35d442ed1f86465e49df3119fb898f985186db13
• https://git.kernel.org/stable/c/640d37fbd34d03af727dbc567f48c0203d1de6b4
• https://git.kernel.org/stable/c/7504b677c4370c9e4b153c553ff8831c093b1ff6

Related Security Bulletins

• Improper locking in Linux kernel fs
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more