All vulnerabilities
CVE-2026-97949

Linux: configfs: unhash the dentry before dropping the item in rmdir

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in446720051d44eebaa81b33969173160057b73a33Also 5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb, 925d8564f1b2d9b46c5ab63b9bc942cea006da9bCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 446720051d44eebaa81b33969173160057b73a33LinuxCVE List
  • 5d7cbfb65e47cc71d5d94d87d5d0d1679080f3ebLinuxCVE List
  • 925d8564f1b2d9b46c5ab63b9bc942cea006da9bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

configfs: unhash the dentry before dropping the item in rmdir

configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window:

BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185

Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them.

Text from CVE List

Affected versions 12

  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before b315d865660766d45ecdbf7433a4e3d36a554b3bCVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before 446720051d44eebaa81b33969173160057b73a33CVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before 5d7cbfb65e47cc71d5d94d87d5d0d1679080f3ebCVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before 925d8564f1b2d9b46c5ab63b9bc942cea006da9bCVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before f06c2d26d1999d37e93299db0ecead04ca7d0b9fCVE List
  • Linuxaffected: 2.6.16CVE List
  • Linuxunaffected: all versions before 2.6.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5