CVE-2026-97950configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing ->ci_dentry create_link() reads the target's configfs_dirent from item->ci_dentry->d_fsdata, relying on the item reference taken by get_target(). That reference pins the item, not its dentry: the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via simple_rmdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->ci_dentry freed and its dirent released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get(). Take the dirent in get_target() as well, under ->d_lock and atomically with the item reference, and pass it down to create_link(). A hashed dentry has not been killed yet, so its ->d_fsdata reference keeps the dirent alive there.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 7063fbf2261194f72ee75afca67b3b38b554b5fa builds before 846ff40fd57a47e59a41f4e331ec3b34efaddc23; 7063fbf2261194f72ee75afca67b3b38b554b5fa builds before 4f54beb2e7f6d399396466682fba3539bcdcb414; from 7063fbf2261194f72ee75afca67b3b38b554b5fa before d47c5de1cd6bfbe1067fc310bf90e4e00205e839; from 7063fbf2261194f72ee75afca67b3b38b554b5fa before a7c1290eef60711c10289c056ad32ed1f2b47b12 | CNA record |
References
- https://git.kernel.org/stable/c/846ff40fd57a47e59a41f4e331ec3b34efaddc23
- https://git.kernel.org/stable/c/4f54beb2e7f6d399396466682fba3539bcdcb414
- https://git.kernel.org/stable/c/d47c5de1cd6bfbe1067fc310bf90e4e00205e839
- https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.