A race condition exists in the Linux kernel’s BPF LSM where BPF programs can modify extended attributes of a file’s inode without holding the inode’s read‑write semaphore. The path_unlink and path_rmdir hooks are invoked before the kernel takes the victim inode’s lock, so a sleepable BPF LSM program attached to these hooks can change or delete xattrs in the interval where the lock is not held. This can result in unintended alteration of file metadata and may compromise data integrity.

Any Linux kernel that implements BPF LSM hooks for unlink or rmdir operations is potentially affected. The affected product is the Linux kernel; no specific released versions are listed, so kernels containing the vulnerable implementation – until the patch that removes the insecure hooks is applied – should be considered at risk.

The CVSS score is not disclosed in the available data, and the EPSS score is not available, so the precise severity and exploitation likelihood are unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local kernel access to load a BPF LSM program that targets the unlink or rmdir hooks; such capability is typically limited to privileged users or compromised processes. The attack vector is local, with the potential to cause integrity problems if successfully triggered.