UBUNTU-CVE-2026-97950: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing ->cidentry createlink() reads the target's configfsdirent from item->cidentry->dfsdata, relying on the item reference taken by gettarget(). That reference pins the item, not its dentry: the dentry is pinned by DCACHEPERSISTENT, which configfsremovedir() releases via simplermdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->cidentry freed and its dirent released, triggering WARNON(!atomicread(&sd->scount)) in configfsget(). Take the dirent in gettarget() as well, under ->dlock and atomically with the item reference, and pass it down to createlink(). A hashed dentry has not been killed yet, so its ->dfsdata reference keeps the dirent alive there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu kernel packages for standard, FIPS, AWS, Azure, GCP, AWS FIPS, Azure FIPS, and GCP FIPS variants. The issue concerns configfs operations.
What is required to trigger the problem?
A symlink creation must race with removal of that symlink's target directory in configfs. The race can cause code to access a freed dentry or released configfs dirent.
How might an affected system show signs of the issue?
The described failure can trigger WARN_ON(!atomic_read(&sd->s_count)) in configfs_get(). Kernel warnings involving that assertion during concurrent configfs symlink and directory-removal activity are an indicator.