CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

configfs: pin the symlink target's dirent instead of chasing ->cidentry

createlink() reads the target's configfsdirent from item->cidentry->dfsdata, relying on the item reference taken by gettarget(). That reference pins the item, not its dentry: the dentry is pinned by DCACHEPERSISTENT, which configfsremovedir() releases via simplermdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->cidentry freed and its dirent released, triggering WARNON(!atomicread(&sd->scount)) in configfsget().

Take the dirent in gettarget() as well, under ->dlock and atomically with the item reference, and pass it down to createlink(). A hashed dentry has not been killed yet, so its ->dfsdata reference keeps the dirent alive there.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:22 AM
Data Sourced
via MITRE·10:22 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

What condition is required to trigger the issue?

A configfs symlink creation must race with removal of the symlink target directory. The target item can remain alive while its dentry and associated configfs dirent have been released by the directory removal path.

2

What symptom may indicate that a system encountered this bug?

The described failure triggers WARN_ON(!atomic_read(&sd->s_count)) in configfs_get(). This warning can occur when symlink creation dereferences the target item's ci_dentry after a concurrent rmdir has freed that dentry and released its dirent.

3

What does the fix change?

The fix takes and retains a reference to the target configfs dirent in get_target(), while holding d_lock and atomically with the item reference. It then passes that dirent to create_link(), rather than retrieving it later through ci_dentry.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203