HIGH Introduced in 2.6.16
configfs Rmdir UAF
CVE-2026-97949
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them.
02KernelScan AI Analysis
Risk summary
A local user can trigger a use-after-free in the configfs filesystem by racing a directory removal against a symlink creation. The race window allows the symlink path to obtain a pointer to a freed kernel configuration object, leading to memory corruption that can cause kernel crashes or potential privilege escalation. Any system with configfs mounted and accessible to local users is affected.
Vulnerability analysis
When a directory is removed from configfs, the filesystem briefly leaves the directory entry visible while the underlying configuration object is freed, creating a window where a concurrent symlink operation can obtain a stale pointer to that freed object. This use-after-free corrupts kernel heap memory. The fix removes the directory entry from the cache immediately after the removal succeeds but before dropping the object reference, closing the race window; any reference obtained just before this remains safe because the symlink creation path checks whether teardown is already in progress. This is reachable by a local user performing standard filesystem operations on a mounted configfs filesystem, requiring no special kernel privileges beyond access to the configfs mount point.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 2.6.16 | 6.12.112 | 446720051d44 |
| 6.18 | 2.6.16 | 6.18.53 | 5d7cbfb65e47 |
| 7.2 | 2.6.16 | 7.2.7 | 925d8564f1b2 |
| mainline | 2.6.16 | 7.3-rc3 | f06c2d26d199 |