In the Linux kernel, the following vulnerability has been resolved:
ovl: fix null pointer dereference in ovl_get_acl_rcu()
Following process: P1 P2 path_openat link_path_walk may_lookup inode_permission(rcu) ovl_permission acl_permission_check check_acl get_cached_acl_rcu ovl_get_inode_acl realinode = ovl_inode_real(ovl_inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL ovl_inode_upper upperdentry = ovl_i_dentry_upper(ovl_inode) d_inode(upperdentry) // returns NULL IS_POSIXACL(realinode) // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 205.472797] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted 6.3.0-12064-g2edfa098e750-dirty #1216 [ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300 [ 205.489584] Call Trace: [ 205.489812] <TASK> [ 205.490014] ovl_get_inode_acl+0x26/0x30 [ 205.490466] get_cached_acl_rcu+0x61/0xa0 [ 205.490908] generic_permission+0x1bf/0x4e0 [ 205.491447] ovl_permission+0x79/0x1b0 [ 205.491917] inode_permission+0x15e/0x2c0 [ 205.492425] link_path_walk+0x115/0x550 [ 205.493311] path_lookupat.isra.0+0xb2/0x200 [ 205.493803] filename_lookup+0xda/0x240 [ 205.495747] vfs_fstatat+0x7b/0xb0
Fetch a reproducer in [Link].
Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.122-77.145Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade python-perfUpgrade perfUpgrade perf-debuginfoUpgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-tools-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.41-63.109Upgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade kernel | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-azureUpgrade linux-riscv-5.15Upgrade linux-aws-5.15Upgrade linux-oracle-5.15Upgrade linux-gkeUpgrade linux-gkeopUpgrade linux-azure-5.15Upgrade linux-ibm-5.15Upgrade linuxUpgrade linux-intel-iotgUpgrade linux-nvidia-tegraUpgrade linux-lowlatencyUpgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-raspiUpgrade linux-nvidiaUpgrade linux-hwe-5.15Upgrade linux-oracleUpgrade linux-kvmUpgrade linux-realtimeUpgrade linux-gcp-5.15Upgrade linux-bluefieldUpgrade linux-awsUpgrade linux-gcpUpgrade linux-nvidia-tegra-igxUpgrade linux-intel-iot-realtimeUpgrade linux-nvidia-tegra-5.15Upgrade linux-lowlatency-hwe-5.15 | Jan 6, 2026 | Jan 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub