Executive brief
A bug in the Linux kernel's kernfs (kernel filesystem) subsystem causes a crash during security policy initialization when using SELinux. The issue occurs when new cgroup directories are created with labeled parents, triggering a null pointer dereference that panics the system at boot time on SELinux-enabled systems.
Technical details
The vulnerability is a null pointer dereference in kernfs caused by incorrect initialization ordering. When __kernfs_new_node() invokes the LSM security_kernfs_init_security hook, the kn->__parent pointer has not yet been set, causing kernfs_root(kn) to return NULL. Subsequent attempts to access the xattr cache via &((struct kernfs_root *)NULL)->xa_cache in selinux_kernfs_init_security() trigger a kernel panic. The fix moves the kernfs_get(parent) and rcu_assign_pointer(kn->__parent) operations to occur before the LSM hook is invoked, ensuring kn->__parent is properly initialized when the security hook runs. This resolves the null pointer dereference and allows kernfs_root() to return the correct root via the parent pointer.
Affected products
- Linux Linux kernel versions with commit 12e9e3cd03b5 (simpe_xattr: use per-sb cache) through the fix
Timeline
- 2026-08-15: disclosed