CVE-2026-97950

A flaw was found in the Linux kernel's configfs filesystem. A local user could exploit a race condition between creating a symbolic link and deleting its target directory to cause a Denial of Service (DoS). When this race condition occurs, the kernel attempts to access a freed directory entry, which can lead to an inconsistent state or a system crash.

A use-after-free race condition was found in the Linux kernel's configfs filesystem. When creating a symbolic link, create_link() reads the target's configfs_dirent through item->ci_dentry->d_fsdata, but the reference taken in get_target() pins the config_item and not its dentry, so configfs_remove_dir() can release the target's dentry and its dirent while the item is still alive. A local user with write access to a configfs mount who wins a race between symlink creation and rmdir of the target directory can cause the kernel to access the freed dentry, triggering a WARN_ON in configfs_get() and potentially a kernel panic, resulting in a local denial of service. This issue is rated MODERATE by Red Hat (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5); no impact to confidentiality or integrity is expected. The affected Red Hat products are the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, the kernel components in Red Hat In-Vehicle OS, and the RHEL CoreOS 8/9 kernels shipped with OpenShift Container Platform 4; for these products the fix is currently deferred. The residual risk of deferring is limited because exploitation requires local access with write permission to a configfs filesystem and success in a narrow timing window, and the consequence is a kernel warning or panic (denial of service) rather than a confidentiality or integrity impact. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.