Bug 2516909 (CVE-2026-74400)

Summary: CVE-2026-74400 kernel: bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel. The BPF (Berkeley Packet Filter) kfuncs `bpf_set_dentry_xattr` and `bpf_remove_dentry_xattr` do not properly check for a null inode when handling negative dentries. This oversight can lead to a null pointer dereference. Additionally, warnings in `bpf_xattr_read_permission()` and `bpf_xattr_write_permission()` could be triggered by similar conditions. On systems configured with `panic_on_warn`, this vulnerability could result in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:39:49 UTC 
In the Linux kernel, the following vulnerability has been resolved:

bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries

bpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF kfuncs attempt to
lock the inode of the supplied dentry without checking if it is
NULL. If a negative dentry is passed (e.g. from
security_inode_create), d_inode(dentry) returns NULL, and
inode_lock(inode) will cause a NULL pointer dereference.

Trivially fix this by adding a NULL check for inode before attempting
to lock it, returning -EINVAL if it is NULL.

Additionally, drop WARN_ON(!inode) in bpf_xattr_read_permission() and
bpf_xattr_write_permission(). These warnings could be triggered by
passing a negative dentry to bpf_get_dentry_xattr() or the _locked
variants of the xattr kfuncs, potentially causing a Denial of Service
on systems with panic_on_warn enabled. Instead, simply return -EINVAL.
Comment 1 Keith Grant 2026-08-20 20:57:14 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081508-CVE-2026-74400-efe2@gregkh/T