CVE-2026-97950

Received Received - Intake

configfs Symlink Use-After-Free in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing ->ci_dentry create_link() reads the target's configfs_dirent from item->ci_dentry->d_fsdata, relying on the item reference taken by get_target(). That reference pins the item, not its dentry: the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via simple_rmdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->ci_dentry freed and its dirent released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get(). Take the dirent in get_target() as well, under ->d_lock and atomically with the item reference, and pass it down to create_link(). A hashed dentry has not been killed yet, so its ->d_fsdata reference keeps the dirent alive there.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97950

EUVD

EUVD-2026-86804

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a race condition in configfs can cause a symlink to access freed memory. The issue occurs when a symlink's target is removed via rmdir while the symlink is being created. The kernel tries to access a configfs_dirent structure that has already been freed, leading to a warning or potential crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's configfs component and may not have direct network detection methods. Monitor kernel logs for warnings related to configfs symlink operations or WARN_ON messages about s_count. Check for kernel version and configfs usage in your system.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or trigger kernel warnings. It may also lead to unexpected behavior if the system relies on configfs for configuration management.

Compliance Impact

This vulnerability is specific to the Linux kernel's configfs component and involves a race condition during symlink creation and directory removal. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel-level filesystem issues.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If immediate patching is not possible, avoid using configfs symlinks in untrusted environments or disable configfs if not required.

Hi! I’m here to help you understand CVE-2026-97950. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70