In the Linux kernel, the following vulnerability has been resolved:
ovl: fix null pointer dereference in ovl_get_acl_rcu()
Following process: P1 P2 path_openat link_path_walk may_lookup inode_permission(rcu) ovl_permission acl_permission_check check_acl get_cached_acl_rcu ovl_get_inode_acl realinode = ovl_inode_real(ovl_inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL ovl_inode_upper upperdentry = ovl_i_dentry_upper(ovl_inode) d_inode(upperdentry) // returns NULL IS_POSIXACL(realinode) // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 205.472797] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted 6.3.0-12064-g2edfa098e750-dirty #1216 [ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300 [ 205.489584] Call Trace: [ 205.489812] <TASK> [ 205.490014] ovl_get_inode_acl+0x26/0x30 [ 205.490466] get_cached_acl_rcu+0x61/0xa0 [ 205.490908] generic_permission+0x1bf/0x4e0 [ 205.491447] ovl_permission+0x79/0x1b0 [ 205.491917] inode_permission+0x15e/0x2c0 [ 205.492425] link_path_walk+0x115/0x550 [ 205.493311] path_lookupat.isra.0+0xb2/0x200 [ 205.493803] filename_lookup+0xda/0x240 [ 205.495747] vfs_fstatat+0x7b/0xb0
Fetch a reproducer in [Link].
Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.122-77.145Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade kernel-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.41-63.109Upgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-libbpfUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade bpftoolUpgrade perf | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libs | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-realtimeUpgrade linux-awsUpgrade linux-nvidia-tegra-igxUpgrade linux-nvidia-tegra-5.15Upgrade linux-gcp-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-gkeopUpgrade linux-lowlatencyUpgrade linux-intel-iotgUpgrade linux-azure-5.15Upgrade linux-gkeUpgrade linux-ibmUpgrade linux-riscv-5.15Upgrade linux-nvidiaUpgrade linux-raspiUpgrade linux-xilinx-zynqmpUpgrade linux-oracleUpgrade linuxUpgrade linux-kvmUpgrade linux-aws-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azureUpgrade linux-hwe-5.15Upgrade linux-oracle-5.15Upgrade linux-nvidia-tegraUpgrade linux-ibm-5.15 | Jan 6, 2026 | Jan 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub