CVE-2026-97949configfs: unhash the dentry before dropping the item in rmdir
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7063fbf2261194f72ee75afca67b3b38b554b5fa before 446720051d44eebaa81b33969173160057b73a33; 7063fbf2261194f72ee75afca67b3b38b554b5fa builds before 5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb; 7063fbf2261194f72ee75afca67b3b38b554b5fa builds before 925d8564f1b2d9b46c5ab63b9bc942cea006da9b; from 7063fbf2261194f72ee75afca67b3b38b554b5fa before f06c2d26d1999d37e93299db0ecead04ca7d0b9f | CNA record |
References
- https://git.kernel.org/stable/c/446720051d44eebaa81b33969173160057b73a33
- https://git.kernel.org/stable/c/5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb
- https://git.kernel.org/stable/c/925d8564f1b2d9b46c5ab63b9bc942cea006da9b
- https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.