Executive brief
The Linux kernel's kernfs subsystem (which manages kernel file system objects) contains a use-after-free bug triggered by concurrent removal operations. An attacker can exploit this through specific syscall sequences to access freed memory, potentially leading to denial of service or information disclosure on affected systems.
Technical details
This vulnerability is a use-after-free in the __kernfs_remove() function within fs/kernfs/dir.c, triggered when concurrent calls to kernfs_remove_by_name_ns() attempt to remove the same file. The race condition occurs during kernfs_drain() when the root node is freed prematurely. An attacker without privileges can trigger concurrent mount/unmount operations (via 9p_fd mount with specific syscall sequences) to cause a freed object to be read. The fix involves acquiring an additional reference for the tree root before calling __kernfs_remove() to prevent premature deallocation.
Affected products
- Linux Linux kernel affected versions through 6.0.0-rc3
Timeline
- 2025-10-01: disclosed