CVE-2026-74342

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kernfs: link kn to its parent before the LSM init hook

After commit 12e9e3cd03b5 ("simpe_xattr: use per-sb cache"),

kernfs_xattr_set() and kernfs_xattr_get() compute the cache via

kernfs_root(kn) before any other check. kernfs_root(kn) walks

kn->__parent first and falls back to kn->dir.root, both of which are

NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set

in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root

is set even later by kernfs_create_dir_ns() / kernfs_create_empty_dir().

The LSM kernfs_init_security hook is invoked from inside

__kernfs_new_node(), before either field has been initialized.

selinux_kernfs_init_security() ends with kernfs_xattr_set(kn,

XATTR_NAME_SELINUX, ...). kernfs_root(kn) then returns NULL, and

&((struct kernfs_root *)NULL)->xa_cache evaluates to

offsetof(struct kernfs_root, xa_cache) which faults:

BUG: kernel NULL pointer dereference, addr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References