CVE-2026-74359
Received Received - Intake

Use-After-Free in Linux Kernel configfs

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: configfs_lookup(): don't leave ->s_dentry dangling on failure Normally ->s_dentry is cleared when dentry it's pointing to becomes negative (on eviction, realistically). However, that only happens if dentry gets to be positive in the first place; in case of inode allocation failure dentry never becomes positive, so ->d_iput() is not called at all. We do part of what normally would've been done by configfs_d_iput() (dropping the reference to configfs_dirent) manually, but we do not clear ->s_dentry there. Sloppy as it is, it does not matter in case of configfs_create_{dir,link}() - there configfs_dirent does not survive dropping the sole reference to it. However, for configfs_lookup() it *does* survive, with a dangling pointer to soon to be freed dentry sitting it its ->s_dentry. Subsequent getdents(2) in that directory will end up dereferencing that pointer in order to pick the inode number. Use after free... This is the minimal fix; the right approach is to set the linkage between dentry and configfs_dirent only after we know that we have an inode, but that takes more surgery and the bug had been there since 2006, so...

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74359
EUVD
EUVD-2026-59506

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the configfs_lookup() function. When a dentry fails to become positive due to inode allocation failure, the s_dentry pointer is not cleared properly. This leaves a dangling pointer to a freed dentry, which can be dereferenced later during getdents(2) operations, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's configfs subsystem and requires kernel-level inspection. Detection involves checking kernel logs for filesystem-related errors or crashes, particularly after operations involving configfs directories or files. Commands like dmesg, journalctl -k, or checking /var/log/kern.log may reveal use-after-free errors or NULL pointer dereferences related to configfs.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) condition by triggering a system crash or memory corruption. It may also enable privilege escalation if exploited to execute arbitrary code, depending on the kernel's memory state at the time of exploitation.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories or kernel updates for a fix. If updating is not immediately possible, avoid using configfs directories or files in untrusted environments until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74359. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart