Executive brief
The Linux kernel's kernfs filesystem component has a race condition in extended attribute (xattr) handling when multiple filesystem instances share the same underlying node structure. An attacker with local access could exploit this timing vulnerability to corrupt or tamper with file metadata, potentially leading to privilege escalation or data integrity issues on systems using kernfs-based filesystems like cgroup or sysfs.
Technical details
The vulnerability is a race condition (CWE-362) in kernfs xattr operations. The root cause is that multiple superblocks with different namespaces can reference the same kernfs_node and its shared xattr structure, but the VFS layer only provides per-inode locking. This means concurrent xattr modifications from different superblock contexts can race in simple_xattr_set() where the lookup-replace/remove sequence is not atomic. The attack vector is local and requires the ability to trigger concurrent xattr operations on a shared kernfs node. The fix protects xattr operations with a hashed per-node mutex array, serializing access across all superblock contexts. A patch is available in the Linux kernel stable tree (commit 6a07814ff643b5c8e1353d8c6229f52fde205cde).
Affected products
- Linux Linux kernel multiple (affected across many versions)
Timeline
- 2026-08-15: disclosed
- 2026-06-05: patched: Upstream fix merged by Christian Brauner
- 2026-07-24: patched: Fix backported to stable series by Greg Kroah-Hartman