{"id":29105,"date":"2026-09-25T20:31:53","date_gmt":"2026-09-25T12:31:53","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97949"},"modified":"2026-09-25T20:31:53","modified_gmt":"2026-09-25T12:31:53","slug":"cve-2026-97949","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97949","title":{"rendered":"CVE-2026-97949 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: unhash the"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>configfs: unhash the dentry before dropping the item in rmdir<\/p>\n<p>configfs_get_config_item() treats a hashed dentry as proof that<br \/>\nsd-&gt;s_element is a live config_item.  configfs_rmdir() breaks that:<br \/>\nsimple_rmdir() leaves the dentry hashed, the last reference to the item is<br \/>\ndropped right after, and the dentry is only unhashed by d_delete() once<br \/>\n-&gt;rmdir() has returned.  configfs_symlink() resolves its target holding no<br \/>\nlock on it, so get_target() can land in that window:<\/p>\n<p>  BUG: KASAN: slab-use-after-free in config_item_get+0x26\/0x90<br \/>\n   get_target fs\/configfs\/symlink.c:128 [inline]<br \/>\n   configfs_symlink+0x4ab\/0x1030 fs\/configfs\/symlink.c:185<\/p>\n<p>Unhash in configfs_remove_dir(), while the item is still guaranteed to be<br \/>\nthere.  A reference obtained just before that stays harmless, as<br \/>\ncreate_link() rechecks CONFIGFS_USET_DROPPING, already set by<br \/>\nconfigfs_detach_prep().  Both configfs_unregister_subsystem() paths<br \/>\nd_drop() after detaching, so this only makes rmdir match them.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>configfs: unhash the dentry before dropping the item in rmdir<\/p>\n<p>configfs_get_config_item() treats a hashed dentry as proof that<br \/>\nsd-&gt;<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29105","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29105"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29105"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}