Not yet scoredPublished Sep 25, 2026

CVE-2026-97949configfs: unhash the dentry before dropping the item in rmdir

Updated under an hour ago (Oct 28, 2026, 12:20 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7063fbf2261194f72ee75afca67b3b38b554b5fa before b315d865660766d45ecdbf7433a4e3d36a554b3b; from 7063fbf2261194f72ee75afca67b3b38b554b5fa before 446720051d44eebaa81b33969173160057b73a33; 7063fbf2261194f72ee75afca67b3b38b554b5fa builds before 5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb; 7063fbf2261194f72ee75afca67b3b38b554b5fa builds before 925d8564f1b2d9b46c5ab63b9bc942cea006da9b; from 7063fbf2261194f72ee75afca67b3b38b554b5fa before f06c2d26d1999d37e93299db0ecead04ca7d0b9f	CNA record

References

References

https://git.kernel.org/stable/c/b315d865660766d45ecdbf7433a4e3d36a554b3b
https://git.kernel.org/stable/c/446720051d44eebaa81b33969173160057b73a33
https://git.kernel.org/stable/c/5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb
https://git.kernel.org/stable/c/925d8564f1b2d9b46c5ab63b9bc942cea006da9b
https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.