In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir… (CVE-2026-98543)

The Linux kernel vulnerability CVE-2026-98543 involves the BPF LSM verifier incorrectly assuming that the inode is locked in the path_unlink and path_rmdir hooks. The functions bpf_[set|remove]_dentry_xattr() are rewritten by the verifier to their _locked variants, which require the caller to hold the inode's i_rwsem lock. However, security_path_unlink() and security_path_rmdir() hooks run before the victim inode's i_rwsem is taken by vfs_unlink()/vfs_rmdir(), allowing a sleepable BPF LSM program attached to these hooks to mutate the victim's xattrs without the lock held. The fix involves removing these two path hooks from the d_inode_locked_hooks list so that the verifier retains the locking variants of the functions, which internally take the lock themselves.

This vulnerability allows a BPF LSM program to modify inode extended attributes without holding the necessary inode lock, potentially leading to race conditions or inconsistent filesystem state. The impact is limited to scenarios where a BPF LSM program is attached to the affected hooks and can execute such mutations. There is no indication of known exploits in the wild.

A fix has been implemented in the Linux kernel by removing the path_unlink and path_rmdir hooks from the d_inode_locked_hooks list, ensuring proper locking is enforced by the verifier. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.