CVE-2026-98543

In the Linux kernel, the following vulnerability has been resolved:

bpf: fs/xattr: don't assume the inode is locked in path unlink/path rmdir

bpf lsm has d inode locked() makes the verifier rewrite bpf [set|remove] dentry xattr() to the locked variants, which assume that the caller already holds the inode's i rwsem. The path unlink and path rmdir hooks are listed, but security path unlink() and security path rmdir() run before vfs unlink()/vfs rmdir() take the victim inode's i rwsem, so a sleepable BPF LSM program attached to either hook mutates the victim's xattrs without the lock held.

Drop the two path hooks from d inode locked hooks so that the verifier keeps the locking bpf [set|remove] dentry xattr() variants, which take the lock themselves.