CVE-2026-97949

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

configfs: unhash the dentry before dropping the item in rmdir

configfs_get_config_item() treats a hashed dentry as proof that

sd->s_element is a live config_item. configfs_rmdir() breaks that:

simple_rmdir() leaves the dentry hashed, the last reference to the item is

dropped right after, and the dentry is only unhashed by d_delete() once

->rmdir() has returned. configfs_symlink() resolves its target holding no

lock on it, so get_target() can land in that window:

BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90

get_target fs/configfs/symlink.c:128 [inline]

configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185

Unhash in configfs_remove_dir(), while the item is still guaranteed to be

there. A reference obtained just before that stays harmless, as

create_link() rechecks CONFIGFS_USET_DROPPING, already set by

configfs_detach_prep(). Both configfs_unregister_subsystem() paths

d_drop() after deta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References