In the Linux kernel, the following vulnerability has been resolved:
ovl: fix null pointer dereference in ovl_get_acl_rcu()
Following process: P1 P2 path_openat link_path_walk may_lookup inode_permission(rcu) ovl_permission acl_permission_check check_acl get_cached_acl_rcu ovl_get_inode_acl realinode = ovl_inode_real(ovl_inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL ovl_inode_upper upperdentry = ovl_i_dentry_upper(ovl_inode) d_inode(upperdentry) // returns NULL IS_POSIXACL(realinode) // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 205.472797] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted 6.3.0-12064-g2edfa098e750-dirty #1216 [ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300 [ 205.489584] Call Trace: [ 205.489812] <TASK> [ 205.490014] ovl_get_inode_acl+0x26/0x30 [ 205.490466] get_cached_acl_rcu+0x61/0xa0 [ 205.490908] generic_permission+0x1bf/0x4e0 [ 205.491447] ovl_permission+0x79/0x1b0 [ 205.491917] inode_permission+0x15e/0x2c0 [ 205.492425] link_path_walk+0x115/0x550 [ 205.493311] path_lookupat.isra.0+0xb2/0x200 [ 205.493803] filename_lookup+0xda/0x240 [ 205.495747] vfs_fstatat+0x7b/0xb0
Fetch a reproducer in [Link].
Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.15.122-77.145Upgrade bpftoolUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade bpftoolUpgrade python3-perfUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-livepatch-6.1.41-63.109Upgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-libbpf-static | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade bpftool | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-realtimeUpgrade linux-nvidia-tegra-5.15Upgrade linux-awsUpgrade linux-nvidia-tegra-igxUpgrade linux-gcpUpgrade linux-lowlatency-hwe-5.15Upgrade linux-bluefieldUpgrade linux-intel-iot-realtimeUpgrade linux-gcp-5.15Upgrade linuxUpgrade linux-hwe-5.15Upgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-gkeUpgrade linux-azureUpgrade linux-intel-iotgUpgrade linux-azure-5.15Upgrade linux-gkeopUpgrade linux-riscv-5.15Upgrade linux-oracle-5.15Upgrade linux-lowlatencyUpgrade linux-aws-5.15Upgrade linux-ibm-5.15Upgrade linux-nvidia-tegraUpgrade linux-xilinx-zynqmpUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-raspiUpgrade linux-nvidia | Jan 6, 2026 | Jan 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub