CVE-2026-97950 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
create_link() reads the target's configfs_dirent from item->ci_dentry->d_fsdata, relying on the item reference taken by get_target(). That reference pins the item, not its dentry: the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via simple_rmdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->ci_dentry freed and its dirent released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().
Take the dirent in get_target() as well, under ->d_lock and atomically with the item reference, and pass it down to create_link(). A hashed dentry has not been killed yet, so its ->d_fsdata reference keeps the dirent alive there.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's configfs subsystem contains a race condition vulnerability within the symlink creation logic that can lead to use-after-free errors and potential system instability. This issue arises from an incorrect assumption regarding object lifetime management during concurrent operations involving directory removal and symbolic link creation. Specifically, the create_link function retrieves the target configuration file system dirent by accessing item->ci_dentry->d_fsdata. The developer's intent was that the reference to the configfs_item taken via get_target would sufficiently pin the necessary data structures for safe access. However, this approach fails because the item reference only pins the high-level item structure, not the underlying dentry object itself.
The core technical flaw lies in how the kernel manages the lifecycle of directory entries versus items within the VFS layer. While the configfs_item is kept alive by a standard reference count, its associated dentry relies on DCACHE_PERSISTENT flags for pinning. When a concurrent rmdir operation occurs, it invokes simple_rmdir which releases this persistent cache flag and frees the dentry structure even while the item remains referenced and active in memory. Consequently, if create_link races with such an rmdir operation, it may attempt to dereference ->ci_dentry after that pointer has been freed or invalidated. This leads to a use-after-free scenario where kernel code accesses memory that is no longer validly mapped for its intended purpose.
The operational impact of this vulnerability manifests as a kernel warning triggered by the assertion WARN_ON(!atomic_read(&sd->s_count)) inside configfs_get(). While immediate exploitation leading to arbitrary code execution may be complex due to the specific nature of the race and subsequent checks, such memory corruption can destabilize the system. It risks causing kernel panics or crashes if the freed memory is reallocated for unrelated purposes before the dangling pointer is accessed again. Furthermore, it violates fundamental security principles regarding safe resource handling in concurrent environments, potentially allowing local attackers to disrupt service availability through denial of service attacks by repeatedly triggering this race condition under heavy load conditions involving rapid directory modifications and symlink creations.
To mitigate this vulnerability, the fix involves modifying get_target() to explicitly take a reference on the dirent itself, not just the item. This additional reference is acquired atomically while holding ->d_lock, ensuring that the dentry remains pinned for as long as it is needed by the caller. By passing this securely held dirent down to create_link(), the code guarantees that the associated fsdata structure cannot be freed prematurely during concurrent removal operations. This change aligns with proper VFS locking semantics and ensures that all necessary objects remain valid throughout the duration of the symlink creation process, effectively eliminating the race window between item reference retention and dentry lifecycle management.
From a classification perspective, this vulnerability corresponds to CWE-416 Use After Free, as it involves accessing memory after it has been freed due to improper lifetime tracking in a multi-threaded context. It also relates to CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization because the bug stems from insufficient locking when multiple threads access shared data structures like dentries and items simultaneously. In terms of MITRE ATT&CK, this falls under T1059 Command Line Interface if an attacker leverages it for denial of service, or more broadly within privilege escalation vectors if such memory corruption is chained with other vulnerabilities to gain higher privileges. The resolution emphasizes the importance of rigorous synchronization primitives and explicit reference counting for all kernel objects involved in concurrent filesystem operations to prevent subtle race conditions that compromise system integrity.