CVE-2026-97949

A flaw was found in the Linux kernel's configfs filesystem. A race condition between directory removal and symbolic link creation can result in a use-after-free vulnerability, where the system attempts to access memory after it has been released. A local user can exploit this flaw by concurrently deleting a directory while creating a symbolic link targeting it, leading to a Denial of Service (DoS) through a kernel crash or potential memory corruption.

A race in configfs can result in a slab use-after-free because configfs_rmdir drops the final config_item reference while the removed dentry remains hashed until the VFS later unhashes it. A concurrent configfs_symlink target lookup can treat the hashed dentry as proof that the config_item is live and call config_item_get on freed memory. This is a local race and is not directly network reachable. For the CVSS the PR:L paranoid value is used because write access to an already mounted configfs subsystem can be delegated to a local service account or container root even when mounting and global configuration require higher privileges. Impact is at least local denial of service through a kernel crash. The confirmed slab use-after-free also creates a plausible worst case risk of confidentiality integrity and privilege impact if freed memory is reused in a controllable way.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.