{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  kernfs: link kn to its parent before the LSM init hook  After commit 12e9e3cd03b5 (\"simpe_xattr: use per-sb cache\"), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check.  kernfs_root(kn) walks kn-\u003e__parent first and falls back to kn-\u003edir.root, both of which are NULL on a freshly kmem_cache_zalloc()'d kn. kn-\u003e__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn-\u003edir.root is set even later by kernfs_create_dir_ns() / kernfs_create_empty_dir().  The LSM kernfs_init_security hook is invoked from inside __kernfs_new_node(), before either field has been initialized. selinux_kernfs_init_security() ends with kernfs_xattr_set(kn, XATTR_NAME_SELINUX, ...).  kernfs_root(kn) then returns NULL, and \u0026((struct kernfs_root *)NULL)-\u003exa_cache evaluates to offsetof(struct kernfs_root, xa_cache) which faults:    BUG: kernel NULL pointer dereference, address: 00000000000000e0   RIP: 0010:simple_xattr_set+0x27/0x8b0   Call Trace:    kernfs_xattr_set+0x63/0xb0    selinux_kernfs_init_security+0x13b/0x270    security_kernfs_init_security+0x36/0xc0    __kernfs_new_node+0x182/0x290    kernfs_new_node+0x80/0xc0    kernfs_create_dir_ns+0x2b/0xa0    cgroup_create+0x116/0x380    cgroup_mkdir+0x7c/0x1a0  Reproduces deterministically at PID 1 (systemd) on an SELinux-enabled distro. The first cgroup mkdir under /sys/fs/cgroup with a labelled parent panics the kernel.  The LSM hook's contract is that the kn_dir argument is the parent of the new kn, so kn-\u003e__parent should already point at kn_dir when the hook runs.  Move kernfs_get(parent) and rcu_assign_pointer of kn-\u003e__parent from kernfs_new_node() into __kernfs_new_node() right before the security hook, and unwind the parent reference on the err_out4 path.  kernfs_root(kn) then takes its parent branch during the hook and returns parent-\u003edir.root, which is the correct root.  This also closes the same-shape latent bug in kernfs_xattr_get() (which today is hidden only by kernfs_iattrs_noalloc() returning NULL on a fresh kn).",
  "id": "DEBIAN-CVE-2026-74342",
  "modified": "2026-09-14T16:47:34.367162785Z",
  "published": "2026-08-15T06:22:35.253Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74342"
    }
  ],
  "upstream": [
    "CVE-2026-74342"
  ]
}