{"id":"CVE-2026-98543","kind":"vulnerability","aliases":["CVE-2026-98543"],"related":[],"title":"Linux kernel: BPF xattr helpers can run without the inode lock held","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode's i_rwsem.  The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode's i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim's xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves.","summary":"A BPF LSM program attached to the path_unlink or path_rmdir hook can change a file's extended attributes while the inode lock is not held. The result is a race on the victim inode's xattrs, which the sources do not show being turned into code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","lsm","runtime"],"not_affected_if":["default-config","no-bpf-lsm-programs"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed by your distribution\n- Check whether BPF LSM programs are loaded: `bpftool prog list` and look for lsm programs attached to path_unlink or path_rmdir","fix":"- Update to a kernel build that includes the upstream fix (unknown version from the sources)\n- Until patched, do not load sleepable BPF LSM programs on path_unlink or path_rmdir","status":"open","published_at":"2026-10-18T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:40+00:00","updated_at":"2026-10-25T05:23:40+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel build that includes the upstream fix (unknown version from the sources)\n- Until patched, do not load sleepable BPF LSM programs on path_unlink or path_rmdir","reach":"local","title":"Linux kernel: BPF xattr helpers can run without the inode lock held","impact":"low","summary":"A BPF LSM program attached to the path_unlink or path_rmdir hook can change a file's extended attributes while the inode lock is not held. The result is a race on the victim inode's xattrs, which the sources do not show being turned into code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf","lsm"],"confidence":0.5,"needs_auth":"unknown","worst_case":"xattrs on victim inodes change without the lock held","analyst_note":"Confirm the fixed kernel version and the affected stable branches from the NVD entry or the upstream kernel commit.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed by your distribution\n- Check whether BPF LSM programs are loaded: `bpftool prog list` and look for lsm programs attached to path_unlink or path_rmdir","needs_analyst":true,"not_affected_if":["no-bpf-lsm-programs","default-config"],"who_is_affected":"Only systems that load BPF LSM programs attached to the path_unlink or path_rmdir hooks can hit this bug. Hosts without BPF LSM programs, or with only the default kernel LSMs, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3533,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98543':15A,18A '/vfs_rmdir':148C 'alreadi':120C 'assum':88C,116C 'attach':29B,162C 'attribut':44B 'bpf':3A,19B,26B,84C,96C,106C,159C,192C 'caller':119C 'chang':39B 'code':72B 'cve':13A,16A 'd':99C,181C 'dentri':109C,195C 'drop':175C 'either':164C 'execut':73B 'extend':43B 'file':41B 'follow':79C 'fs/xattr':85C 'held':12A,51B,174C 'helper':5A 'hold':121C 'hook':37B,133C,165C,179C,184C 'inod':10A,47B,60B,90C,100C,123C,152C,182C 'keep':189C 'kernel':2A,22B,77C 'linux':1A,21B,76C 'linux-kernel':20B 'list':135C 'lock':11A,48B,92C,101C,113C,173C,183C,191C,201C 'lsm':23B,27B,97C,160C 'make':102C 'mutat':166C 'path':32B,35B,94C,128C,131C,138C,142C,178C 'program':28B,161C 'race':56B 'remov':108C,194C 'resolv':83C 'result':53B 'rewrit':105C 'rmdir':36B,132C,143C 'run':7A,144C 'runtim':24B 'rwsem':126C,155C 'secur':137C,141C 'set':107C,193C 'show':68B 'sleepabl':158C 'sourc':65B 'take':149C,199C 'turn':70B 'two':177C 'unlink':33B,129C,139C,147C 'unlink/path_rmdir':95C 'variant':114C,197C 'verifi':104C,188C 'vfs':146C 'victim':59B,151C,168C 'vulner':80C 'without':8A,171C 'xattr':4A,62B,110C,170C,196C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load BPF LSM programs attached to the path_unlink or path_rmdir hooks can hit this bug. Hosts without BPF LSM programs, or with only the default kernel LSMs, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98543","severity":null,"published_at":"2026-10-18T16:17:06+00:00","modified_at":"2026-10-19T10:19:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}