---
id: "CVE-2026-98543"
kind: "vulnerability"
aliases: ["CVE-2026-98543"]
title: "Linux kernel: BPF xattr helpers can run without the inode lock held"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bpf", "linux-kernel", "lsm", "runtime"]
not_affected_if: ["default-config", "no-bpf-lsm-programs"]
published_at: "2026-10-18T16:17:06+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98543", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: BPF xattr helpers can run without the inode lock held

A BPF LSM program attached to the path_unlink or path_rmdir hook can change a file's extended attributes while the inode lock is not held. The result is a race on the victim inode's xattrs, which the sources do not show being turned into code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds listed by your distribution
- Check whether BPF LSM programs are loaded: `bpftool prog list` and look for lsm programs attached to path_unlink or path_rmdir

## Fix

- Update to a kernel build that includes the upstream fix (unknown version from the sources)
- Until patched, do not load sleepable BPF LSM programs on path_unlink or path_rmdir

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98543

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

bpf_lsm_has_d_inode_locked() makes the verifier rewrite
bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
that the caller already holds the inode's i_rwsem.  The path_unlink and
path_rmdir hooks are listed, but security_path_unlink() and
security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
victim inode's i_rwsem, so a sleepable BPF LSM program attached to
either hook mutates the victim's xattrs without the lock held.

Drop the two path hooks from d_inode_locked_hooks so that the verifier
keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
the lock themselves.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_