CVE-2026-74343 (GCVE-0-2026-74343)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
kernfs: fix xattr race condition with multiple superblocks
Summary
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfs_node when kernfs_test_super() finds a matching root but different namespace. This means multiple inodes from different superblocks can reference the same kernfs_node->iattr->xattrs structure. The VFS layer only holds per-inode locks during xattr operations, which is insufficient to serialize concurrent xattr modifications on the shared kernfs_node. This can lead to race conditions in simple_xattr_set() where the lookup->replace/remove sequence is not atomic with respect to operations from other superblocks. Fix this by protecting xattr operations with the existing hashed kernfs_locks->open_file_mutex[] array, which is already used to protect per-node open file data. The hashed mutex array provides scalable per-node serialization (scaled by CPU count, up to 1024 locks on 32+ CPU systems) with zero memory overhead. Changes: - Rename open_file_mutex[] to node_mutex[] to reflect dual purpose - Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers - Protect simple_xattr_set() calls in kernfs_xattr_set() and kernfs_vfs_user_xattr_set() with the hashed mutex - Update file.c to use new helpers via compatibility wrappers - Update documentation to explain the extended lock usage
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b32c4a213698ab351b44da2fd1b2a5976c7fa033 , < bf53db51359939755084d08156684ed649489592 (git)
Affected: b32c4a213698ab351b44da2fd1b2a5976c7fa033 , < 6a07814ff643b5c8e1353d8c6229f52fde205cde (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/kernfs/file.c",
            "fs/kernfs/inode.c",
            "fs/kernfs/kernfs-internal.h",
            "fs/kernfs/mount.c",
            "include/linux/kernfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf53db51359939755084d08156684ed649489592",
              "status": "affected",
              "version": "b32c4a213698ab351b44da2fd1b2a5976c7fa033",
              "versionType": "git"
            },
            {
              "lessThan": "6a07814ff643b5c8e1353d8c6229f52fde205cde",
              "status": "affected",
              "version": "b32c4a213698ab351b44da2fd1b2a5976c7fa033",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/kernfs/file.c",
            "fs/kernfs/inode.c",
            "fs/kernfs/kernfs-internal.h",
            "fs/kernfs/mount.c",
            "include/linux/kernfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernfs: fix xattr race condition with multiple superblocks\n\nMultiple superblocks with different namespaces can share the same\nkernfs_node when kernfs_test_super() finds a matching root but\ndifferent namespace. This means multiple inodes from different\nsuperblocks can reference the same kernfs_node-\u003eiattr-\u003exattrs\nstructure.\n\nThe VFS layer only holds per-inode locks during xattr operations,\nwhich is insufficient to serialize concurrent xattr modifications on\nthe shared kernfs_node. This can lead to race conditions in\nsimple_xattr_set() where the lookup-\u003ereplace/remove sequence is not\natomic with respect to operations from other superblocks.\n\nFix this by protecting xattr operations with the existing hashed\nkernfs_locks-\u003eopen_file_mutex[] array, which is already used to\nprotect per-node open file data. The hashed mutex array provides\nscalable per-node serialization (scaled by CPU count, up to 1024 locks\non 32+ CPU systems) with zero memory overhead.\n\nChanges:\n- Rename open_file_mutex[] to node_mutex[] to reflect dual purpose\n- Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers\n- Protect simple_xattr_set() calls in kernfs_xattr_set() and\n  kernfs_vfs_user_xattr_set() with the hashed mutex\n- Update file.c to use new helpers via compatibility wrappers\n- Update documentation to explain the extended lock usage"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local VFS xattr operations (setxattr/fsetxattr syscalls) on kernfs-backed mounts such as cgroup2 and sysfs; there is no network-facing handler or remote pre-auth path to the vulnerable code.\nAC:L - The attacker fully controls both racing threads by mounting the same kernfs hierarchy from different namespace-tagged superblocks (e.g. sysfs in two network namespaces) and issuing concurrent setxattr calls against the same shared kernfs_node.\nPR:L - Exploitation requires only local user capabilities obtainable in an unprivileged user namespace (CAP_SYS_ADMIN to create namespaces and mount cgroup2/sysfs), not init-namespace root or host administrator privileges.\nUI:N - No victim interaction is required; the attacker mounts the filesystems, selects the target kernfs_node, and triggers the race with their own concurrent setxattr operations.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel/host security boundary; this is not a VM escape, sandbox breakout, or cross-authority scope change.\nC:H - Concurrent unsynchronized simple_xattr_set() on a shared rhashtable/list can cause use-after-free and heap corruption, which is readily weaponizable for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - The race corrupts shared xattr rhashtable and list structures, enabling use-after-free and heap metadata corruption that can be leveraged for arbitrary kernel writes and local privilege escalation/code execution.\nA:H - The race can trigger kernel oops/panic from list/rhashtable corruption or use-after-free during concurrent replace/remove/free paths, causing complete loss of kernel availability even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:08.382Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf53db51359939755084d08156684ed649489592"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a07814ff643b5c8e1353d8c6229f52fde205cde"
        }
      ],
      "title": "kernfs: fix xattr race condition with multiple superblocks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74343",
    "datePublished": "2026-08-15T05:58:32.577Z",
    "dateReserved": "2026-08-15T05:44:03.886Z",
    "dateUpdated": "2026-08-17T05:46:08.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74343",
      "date": "2026-09-21",
      "epss": "0.0012",
      "percentile": "0.02133"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/kernfs/file.c",
                  "fs/kernfs/inode.c",
                  "fs/kernfs/kernfs-internal.h",
                  "fs/kernfs/mount.c",
                  "include/linux/kernfs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bf53db51359939755084d08156684ed649489592",
                    "status": "affected",
                    "version": "b32c4a213698ab351b44da2fd1b2a5976c7fa033",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6a07814ff643b5c8e1353d8c6229f52fde205cde",
                    "status": "affected",
                    "version": "b32c4a213698ab351b44da2fd1b2a5976c7fa033",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/kernfs/file.c",
                  "fs/kernfs/inode.c",
                  "fs/kernfs/kernfs-internal.h",
                  "fs/kernfs/mount.c",
                  "include/linux/kernfs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernfs: fix xattr race condition with multiple superblocks\n\nMultiple superblocks with different namespaces can share the same\nkernfs_node when kernfs_test_super() finds a matching root but\ndifferent namespace. This means multiple inodes from different\nsuperblocks can reference the same kernfs_node-\u003eiattr-\u003exattrs\nstructure.\n\nThe VFS layer only holds per-inode locks during xattr operations,\nwhich is insufficient to serialize concurrent xattr modifications on\nthe shared kernfs_node. This can lead to race conditions in\nsimple_xattr_set() where the lookup-\u003ereplace/remove sequence is not\natomic with respect to operations from other superblocks.\n\nFix this by protecting xattr operations with the existing hashed\nkernfs_locks-\u003eopen_file_mutex[] array, which is already used to\nprotect per-node open file data. The hashed mutex array provides\nscalable per-node serialization (scaled by CPU count, up to 1024 locks\non 32+ CPU systems) with zero memory overhead.\n\nChanges:\n- Rename open_file_mutex[] to node_mutex[] to reflect dual purpose\n- Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers\n- Protect simple_xattr_set() calls in kernfs_xattr_set() and\n  kernfs_vfs_user_xattr_set() with the hashed mutex\n- Update file.c to use new helpers via compatibility wrappers\n- Update documentation to explain the extended lock usage"
          }
        ],
        "id": "CVE-2026-74343",
        "lastModified": "2026-08-17T06:19:28.850",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:35.370",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a07814ff643b5c8e1353d8c6229f52fde205cde"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf53db51359939755084d08156684ed649489592"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T20:52:51+00:00",
      "cve": "CVE-2026-74343",
      "id": "CVE-2026-74343",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kernfs: fix xattr race condition with multiple superblocks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74343.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:07:07Z",
      "cve": "CVE-2026-74343",
      "id": "CVE-2026-74343",
      "initial_release_date": "2026-09-03T00:07:07Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74343",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74343.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.