CVE-2026-74400bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries bpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passed (e.g. from security_inode_create), d_inode(dentry) returns NULL, and inode_lock(inode) will cause a NULL pointer dereference. Trivially fix this by adding a NULL check for inode before attempting to lock it, returning -EINVAL if it is NULL. Additionally, drop WARN_ON(!inode) in bpf_xattr_read_permission() and bpf_xattr_write_permission(). These warnings could be triggered by passing a negative dentry to bpf_get_dentry_xattr() or the _locked variants of the xattr kfuncs, potentially causing a Denial of Service on systems with panic_on_warn enabled. Instead, simply return -EINVAL.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 56467292794b800164df20c076c409ac548e56ec before e003f3a4be738f650e283e92d07017c3fef8da52; 56467292794b800164df20c076c409ac548e56ec builds before 0160edf2af51c5fde742973742c5d10497901b21; 56467292794b800164df20c076c409ac548e56ec builds before 07410646f6ff1d23222f105ccab778957d401bbe | CNA record |
References
- https://git.kernel.org/stable/c/e003f3a4be738f650e283e92d07017c3fef8da52
- https://git.kernel.org/stable/c/0160edf2af51c5fde742973742c5d10497901b21
- https://git.kernel.org/stable/c/07410646f6ff1d23222f105ccab778957d401bbe
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.