{
  "cveId": "CVE-2026-74342",
  "url": "https://patchblox.com/security/cve/CVE-2026-74342",
  "summary": "CVE-2026-74342 is fixed in linux on 1 platform by DEBIAN-CVE-2026-74342 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "kernfs: link kn to its parent before the LSM init hook",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  kernfs: link kn to its parent before the LSM init hook  After commit 12e9e3cd03b5 (\u0022simpe_xattr: use per-sb cache\u0022), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check.  kernfs_root(kn) walks kn-\u003E__parent first and falls back to kn-\u003Edir.root, both of which are NULL on a freshly kmem_cache_zalloc()\u0027d kn. kn-\u003E__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn-\u003Edir.root is set even later by kernfs_create_dir_ns() / kernfs_create_empty_dir().  The LSM kernfs_init_security hook is invoked from inside __kernfs_new_node(), before either field has been initialized. selinux_kernfs_init_security() ends with kernfs_xattr_set(kn, XATTR_NAME_SELINUX, ...).  kernfs_root(kn) then returns NULL, and \u0026((struct kernfs_root *)NULL)-\u003Exa_cache evaluates to offsetof(struct kernfs_root, xa_cache) which faults:    BUG: kernel NULL pointer dereference, address: 00000000000000e0   RIP: 0010:simple_xattr_set\u002B0x27/0x8b0   Call Trace:    kernfs_xattr_set\u002B0x63/0xb0    selinux_kernfs_init_security\u002B0x13b/0x270    security_kernfs_init_security\u002B0x36/0xc0    __kernfs_new_node\u002B0x182/0x290    kernfs_new_node\u002B0x80/0xc0    kernfs_create_dir_ns\u002B0x2b/0xa0    cgroup_create\u002B0x116/0x380    cgroup_mkdir\u002B0x7c/0x1a0  Reproduces deterministically at PID 1 (systemd) on an SELinux-enabled distro. The first cgroup mkdir under /sys/fs/cgroup with a labelled parent panics the kernel.  The LSM hook\u0027s contract is that the kn_dir argument is the parent of the new kn, so kn-\u003E__parent should already point at kn_dir when the hook runs.  Move kernfs_get(parent) and rcu_assign_pointer of kn-\u003E__parent from kernfs_new_node() into __kernfs_new_node() right before the security hook, and unwind the parent reference on the err_out4 path.  kernfs_root(kn) then takes its parent branch during the hook and returns parent-\u003Edir.root, which is the correct root.  This also closes the same-shape latent bug in kernfs_xattr_get() (which today is hidden only by kernfs_iattrs_noalloc() returning NULL on a fresh kn).",
  "published": "2026-08-15T06:22:35Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "epss": 0.00198,
  "epssPercentile": 0.09576,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-74342",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-74342",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74342",
      "released": "2026-08-15T22:38:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}