Linux Kernel EUVD-2026-103588

Requires a Linux kernel 6.15 or later built with BPF LSM support AND a sleepable BPF LSM program attached to the path_unlink or path_rmdir hooks that calls bpf_set_dentry_xattr() or bpf_remove_dentry_xattr(); the verifier rewrites these to the _locked variants that assume i_rwsem is held, but it is not held at those hook points. Loading/attaching such a BPF LSM program requires privilege (typically CAP_BPF/CAP_SYS_ADMIN). If no such program is attached to these specific hooks, the vulnerable code path is never reached and the system is not exploitable - this confines exposure to specialized security-tooling deployments rather than default kernel configurations. The triggering operation itself is an ordinary local unlink/rmdir, requiring no user interaction (UI:N).

CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H) describes a local, low-privilege flaw with changed scope causing integrity (I:L) and availability (A:H) impact and no confidentiality impact. The exploitation-probability signals are low and consistent with each other: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit is identified. The vuln.today decision label is 'this_week', indicating a prioritized-but-not-emergency fix cadence. These signals converge: this is a genuine correctness/locking bug worth patching on a normal cadence, not a widely-weaponized threat. A key limiting factor tempers the raw score - the vulnerable path is only reachable when a sleepable BPF LSM program that mutates dentry xattrs is attached to path_unlink/path_rmdir, which is a non-default, security-tooling-specific deployment; loading such a program itself requires privilege, so PR:L is arguably generous for the overall condition even though the triggering file operation (unlink/rmdir) can be performed by a low-privileged local user. One conflicting signal: the input tag 'Information Disclosure' contradicts the CVSS vector's C:N (no confidentiality impact), so that classification should not be relied upon. No SSVC decision-framework fields (automatable / technical impact / exploitation) were provided in the input, so SSVC-based prioritization cannot be independently computed here.

On a host whose kernel (6.15+) runs a sleepable BPF LSM program that calls bpf_set_dentry_xattr()/bpf_remove_dentry_xattr() from the path_unlink or path_rmdir hooks, a local user performs an unlink or rmdir operation. Because security_path_unlink()/security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the victim inode's i_rwsem, the program mutates the victim's xattrs without the lock held, allowing unlocked concurrent access that can corrupt inode state or crash the kernel. No public exploit identified at time of analysis; the attack vector is local (AV:L) with low complexity (AC:L).