Executive brief
The Linux kernel's BPF subsystem contains functions for reading and modifying extended file attributes (xattrs) that can crash when given invalid directory entries. An attacker with appropriate BPF program loading privileges can trigger a kernel panic by passing specially crafted inputs, causing a denial of service and system downtime.
Technical details
The vulnerability is a null pointer dereference in the BPF kfuncs bpf_set_dentry_xattr, bpf_remove_dentry_xattr, and related xattr permission functions. These functions attempt to lock an inode retrieved from a dentry without first checking if the pointer is NULL. If a negative dentry is passed (representing a non-existent file, such as from security_inode_create hooks), d_inode(dentry) returns NULL, and subsequent inode_lock(inode) dereferences the NULL pointer, causing a kernel crash. Additionally, WARN_ON macros in bpf_xattr_read_permission and bpf_xattr_write_permission can trigger kernel panic on systems with panic_on_warn enabled. The fix adds NULL checks before inode operations and replaces WARN_ON with simple conditional returns of -EINVAL. BPF program loading typically requires CAP_BPF or CAP_SYS_ADMIN privileges.
Affected products
- Linux Linux kernel 5.8 and later (where BPF xattr kfuncs were introduced)
Timeline
- 2026-04-30: disclosed
- 2026-05-11: patched