Riskcovery

CVE-2026-97949

configfs: unhash the dentry before dropping the item in rmdir

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 21, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

configfs: unhash the dentry before dropping the item in rmdir

configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window:

BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185

Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7063fbf2261194f72ee75afca67b3b38b554b5fa to before b315d865660766d45ecdbf7433a4e3d36a554b3bAffected
  • 7063fbf2261194f72ee75afca67b3b38b554b5fa to before 446720051d44eebaa81b33969173160057b73a33Affected
  • 7063fbf2261194f72ee75afca67b3b38b554b5fa to before 5d7cbfb65e47cc71d5d94d87d5d0d1679080f3ebAffected
  • 7063fbf2261194f72ee75afca67b3b38b554b5fa to before 925d8564f1b2d9b46c5ab63b9bc942cea006da9bAffected
  • 7063fbf2261194f72ee75afca67b3b38b554b5fa to before f06c2d26d1999d37e93299db0ecead04ca7d0b9fAffected
LinuxLinux
  • 2.6.16Affected
  • before 2.6.16Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.