{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74343","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.886Z","datePublished":"2026-08-15T05:58:32.577Z","dateUpdated":"2026-08-17T05:46:08.382Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:46:08.382Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkernfs: fix xattr race condition with multiple superblocks\n\nMultiple superblocks with different namespaces can share the same\nkernfs_node when kernfs_test_super() finds a matching root but\ndifferent namespace. This means multiple inodes from different\nsuperblocks can reference the same kernfs_node->iattr->xattrs\nstructure.\n\nThe VFS layer only holds per-inode locks during xattr operations,\nwhich is insufficient to serialize concurrent xattr modifications on\nthe shared kernfs_node. This can lead to race conditions in\nsimple_xattr_set() where the lookup->replace/remove sequence is not\natomic with respect to operations from other superblocks.\n\nFix this by protecting xattr operations with the existing hashed\nkernfs_locks->open_file_mutex[] array, which is already used to\nprotect per-node open file data. The hashed mutex array provides\nscalable per-node serialization (scaled by CPU count, up to 1024 locks\non 32+ CPU systems) with zero memory overhead.\n\nChanges:\n- Rename open_file_mutex[] to node_mutex[] to reflect dual purpose\n- Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers\n- Protect simple_xattr_set() calls in kernfs_xattr_set() and\n  kernfs_vfs_user_xattr_set() with the hashed mutex\n- Update file.c to use new helpers via compatibility wrappers\n- Update documentation to explain the extended lock usage"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local VFS xattr operations (setxattr/fsetxattr syscalls) on kernfs-backed mounts such as cgroup2 and sysfs; there is no network-facing handler or remote pre-auth path to the vulnerable code.\nAC:L - The attacker fully controls both racing threads by mounting the same kernfs hierarchy from different namespace-tagged superblocks (e.g. sysfs in two network namespaces) and issuing concurrent setxattr calls against the same shared kernfs_node.\nPR:L - Exploitation requires only local user capabilities obtainable in an unprivileged user namespace (CAP_SYS_ADMIN to create namespaces and mount cgroup2/sysfs), not init-namespace root or host administrator privileges.\nUI:N - No victim interaction is required; the attacker mounts the filesystems, selects the target kernfs_node, and triggers the race with their own concurrent setxattr operations.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel/host security boundary; this is not a VM escape, sandbox breakout, or cross-authority scope change.\nC:H - Concurrent unsynchronized simple_xattr_set() on a shared rhashtable/list can cause use-after-free and heap corruption, which is readily weaponizable for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - The race corrupts shared xattr rhashtable and list structures, enabling use-after-free and heap metadata corruption that can be leveraged for arbitrary kernel writes and local privilege escalation/code execution.\nA:H - The race can trigger kernel oops/panic from list/rhashtable corruption or use-after-free during concurrent replace/remove/free paths, causing complete loss of kernel availability even without full exploitation."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/kernfs/file.c","fs/kernfs/inode.c","fs/kernfs/kernfs-internal.h","fs/kernfs/mount.c","include/linux/kernfs.h"],"versions":[{"version":"b32c4a213698ab351b44da2fd1b2a5976c7fa033","lessThan":"bf53db51359939755084d08156684ed649489592","status":"affected","versionType":"git"},{"version":"b32c4a213698ab351b44da2fd1b2a5976c7fa033","lessThan":"6a07814ff643b5c8e1353d8c6229f52fde205cde","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/kernfs/file.c","fs/kernfs/inode.c","fs/kernfs/kernfs-internal.h","fs/kernfs/mount.c","include/linux/kernfs.h"],"versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/bf53db51359939755084d08156684ed649489592"},{"url":"https://git.kernel.org/stable/c/6a07814ff643b5c8e1353d8c6229f52fde205cde"}],"title":"kernfs: fix xattr race condition with multiple superblocks","x_generator":{"engine":"bippy-1.2.0"}}}}