CVE-2026-74342 - Vulnerability Details

- kernfs: link kn to its parent before the LSM init hook

Description

In the Linux kernel, the following vulnerability has been resolved:

kernfs: link kn to its parent before the LSM init hook

After commit 12e9e3cd03b5 ("simpe_xattr: use per-sb cache"),
kernfs_xattr_set() and kernfs_xattr_get() compute the cache via
kernfs_root(kn) before any other check. kernfs_root(kn) walks
kn->__parent first and falls back to kn->dir.root, both of which are
NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set
in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root
is set even later by kernfs_create_dir_ns() / kernfs_create_empty_dir().

The LSM kernfs_init_security hook is invoked from inside
__kernfs_new_node(), before either field has been initialized.
selinux_kernfs_init_security() ends with kernfs_xattr_set(kn,
XATTR_NAME_SELINUX, ...). kernfs_root(kn) then returns NULL, and
&((struct kernfs_root *)NULL)->xa_cache evaluates to
offsetof(struct kernfs_root, xa_cache) which faults:

BUG: kernel NULL pointer dereference, address: 00000000000000e0
RIP: 0010:simple_xattr_set+0x27/0x8b0
Call Trace:
kernfs_xattr_set+0x63/0xb0
selinux_kernfs_init_security+0x13b/0x270
security_kernfs_init_security+0x36/0xc0
__kernfs_new_node+0x182/0x290
kernfs_new_node+0x80/0xc0
kernfs_create_dir_ns+0x2b/0xa0
cgroup_create+0x116/0x380
cgroup_mkdir+0x7c/0x1a0

Reproduces deterministically at PID 1 (systemd) on an SELinux-enabled
distro. The first cgroup mkdir under /sys/fs/cgroup with a labelled
parent panics the kernel.

The LSM hook's contract is that the kn_dir argument is the parent of
the new kn, so kn->__parent should already point at kn_dir when the
hook runs. Move kernfs_get(parent) and rcu_assign_pointer of
kn->__parent from kernfs_new_node() into __kernfs_new_node() right
before the security hook, and unwind the parent reference on the
err_out4 path. kernfs_root(kn) then takes its parent branch during
the hook and returns parent->dir.root, which is the correct root.

This also closes the same-shape latent bug in kernfs_xattr_get() (which
today is hidden only by kernfs_iattrs_noalloc() returning NULL on a
fresh kn).

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An uninitialized pointer dereference occurs during the LSM initialization hook in the Linux kernel’s kernfs subsystem. The bug leads to a kernel panic when a SELinux‑enabled system creates its first cgroup under /sys/fs/cgroup, causing a complete system halt. The error is deterministic and triggers during startup, impacting system availability.

Affected Systems

All Linux kernel releases containing the vulnerable kernfs code—specifically those prior the commit that moved the parent linkage before the security hook. The issue manifests on systems running SELinux and performing cgroup operations, a common scenario on most modern Linux distributions.

Risk and Exploitability

The vulnerability results in a kernel crash, effectively denying service. The severity is moderate, with a CVSS score of 5.5; the EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The attack requires local privileged conditions, such as the ability to create a new cgroup, and the exploitation probability is low but non‑zero due to the deterministic nature of the crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 319b82e8b46edaf557436ad858e734e583f78ec9
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6cccc49b027c7551ffc1d2532f2ef1922661f3da
`0`	affected	< 7.1.5

Linux

affected

Version	Status	Constraints
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,319b82e8b46edaf557436ad858e734e583f78ec9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6cccc49b027c7551ffc1d2532f2ef1922661f3da)`	affected	code_commit	—
`[0,7.1.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a release that includes the fix moving the parent linkage before the LSM security hook, which eliminates the uninitialized pointer dereference (CWE-476).
If the kernel cannot be updated immediately, temporarily disable SELinux enforcement during cgroup operations or avoid creating new cgroups until the patch is applied to prevent the kernel panic caused by the uninitialized pointer.
Monitor system logs for kernel panics or unexpected reboots that may indicate exploitation of the uninitialized pointer dereference in kernfs.

Generated by OpenCVE AI on August 22, 2026 at 03:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00155.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/319b82e8b46edaf557436ad858e734e583f78ec9
https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da
https://lore.kernel.org/linux-cve-announce/2026081557-CVE-2026-74342-511d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74342
https://www.cve.org/CVERecord?id=CVE-2026-74342

History

Sat, 22 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-457

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081557-CVE-2026-74342-511d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74342 https://www.cve.org/CVERecord?id=CVE-2026-74342
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-457 CWE-476

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 ("simpe_xattr: use per-sb cache"), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check. kernfs_root(kn) walks kn->__parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root is set even later by kernfs_create_dir_ns() / kernfs_create_empty_dir(). The LSM kernfs_init_security hook is invoked from inside __kernfs_new_node(), before either field has been initialized. selinux_kernfs_init_security() ends with kernfs_xattr_set(kn, XATTR_NAME_SELINUX, ...). kernfs_root(kn) then returns NULL, and &((struct kernfs_root *)NULL)->xa_cache evaluates to offsetof(struct kernfs_root, xa_cache) which faults: BUG: kernel NULL pointer dereference, address: 00000000000000e0 RIP: 0010:simple_xattr_set+0x27/0x8b0 Call Trace: kernfs_xattr_set+0x63/0xb0 selinux_kernfs_init_security+0x13b/0x270 security_kernfs_init_security+0x36/0xc0 __kernfs_new_node+0x182/0x290 kernfs_new_node+0x80/0xc0 kernfs_create_dir_ns+0x2b/0xa0 cgroup_create+0x116/0x380 cgroup_mkdir+0x7c/0x1a0 Reproduces deterministically at PID 1 (systemd) on an SELinux-enabled distro. The first cgroup mkdir under /sys/fs/cgroup with a labelled parent panics the kernel. The LSM hook's contract is that the kn_dir argument is the parent of the new kn, so kn->__parent should already point at kn_dir when the hook runs. Move kernfs_get(parent) and rcu_assign_pointer of kn->__parent from kernfs_new_node() into __kernfs_new_node() right before the security hook, and unwind the parent reference on the err_out4 path. kernfs_root(kn) then takes its parent branch during the hook and returns parent->dir.root, which is the correct root. This also closes the same-shape latent bug in kernfs_xattr_get() (which today is hidden only by kernfs_iattrs_noalloc() returning NULL on a fresh kn).
Title		kernfs: link kn to its parent before the LSM init hook
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/319b82e8b46edaf557436ad858e734e583f78ec9 https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:31.924Z

Updated: 2026-08-17T05:17:34.554Z

Reserved: 2026-08-15T05:44:03.886Z

Link: CVE-2026-74342

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:35.253

Modified: 2026-08-17T06:19:28.763

Link: CVE-2026-74342

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74342 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T03:45:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object