CVE-2026-97950

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

create_link() reads the target's configfs_dirent from

item->ci_dentry->d_fsdata, relying on the item reference taken by

get_target(). That reference pins the item, not its dentry: the dentry is

pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via

simple_rmdir() while the item is still alive. A symlink racing with rmdir

of its target can therefore find ->ci_dentry freed and its dirent

released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().

Take the dirent in get_target() as well, under ->d_lock and atomically

with the item reference, and pass it down to create_link(). A hashed

dentry has not been killed yet, so its ->d_fsdata reference keeps the

dirent alive there.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References