CVE-2026-97950 configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
A race condition in the Linux kernel configfs subsystem allows a local attacker to trigger a use-after-free, causing a kernel warning and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97950?
CVE-2026-97950 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
create_link() reads the target's configfs_dirent from item->ci_dentry->d_fsdata, relying on the item reference taken by get_target(). That reference pins the item, not its dentry: the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via simple_rmdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->ci_dentry freed and its dirent released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().
Take the dirent in get_target() as well, under ->d_lock and atomically with the item reference, and pass it down to create_link(). A hashed dentry has not been killed yet, so its ->d_fsdata reference keeps the dirent alive there.
Which versions are affected by CVE-2026-97950?
How do I fix CVE-2026-97950?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-97950 being exploited?
There is no known exploitation of CVE-2026-97950 in the wild and no public exploit code.
Sources
Also known as AZL-104570, BELL-CVE-2026-97950, DEBIAN-CVE-2026-97950, GHSA-6xvc-m8wh-p8q8, UBUNTU-CVE-2026-97950.