All vulnerabilities
CVE-2026-97950

Linux: configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in846ff40fd57a47e59a41f4e331ec3b34efaddc23Also 4f54beb2e7f6d399396466682fba3539bcdcb414CVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 846ff40fd57a47e59a41f4e331ec3b34efaddc23LinuxCVE List
  • 4f54beb2e7f6d399396466682fba3539bcdcb414LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

create_link() reads the target's configfs_dirent from item->ci_dentry->d_fsdata, relying on the item reference taken by get_target(). That reference pins the item, not its dentry: the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via simple_rmdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->ci_dentry freed and its dirent released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().

Take the dirent in get_target() as well, under ->d_lock and atomically with the item reference, and pass it down to create_link(). A hashed dentry has not been killed yet, so its ->d_fsdata reference keeps the dirent alive there.

Text from CVE List

Affected versions 12

  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before a44744454eafbc158e8c8e3ef8d207076410b195CVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before 846ff40fd57a47e59a41f4e331ec3b34efaddc23CVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before 4f54beb2e7f6d399396466682fba3539bcdcb414CVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before d47c5de1cd6bfbe1067fc310bf90e4e00205e839CVE List
  • Linuxaffected: 7063fbf2261194f72ee75afca67b3b38b554b5fa before a7c1290eef60711c10289c056ad32ed1f2b47b12CVE List
  • Linuxaffected: 2.6.16CVE List
  • Linuxunaffected: all versions before 2.6.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5