Executive brief
The Linux kernel's configfs filesystem has a synchronization bug in how it protects directory listing operations. While parent directory locks prevent entries from being deleted, they do not protect cursors (position markers used during directory reads) from being moved or freed by concurrent lseek() calls. This can lead to use-after-free conditions or reading from invalid memory during directory enumeration, potentially causing system crashes or information disclosure.
Technical details
The vulnerability is a race condition in fs/configfs/dir.c in lockless list traversals of the configfs_dirent->s_children list. The root cause is that having the parent directory locked protects entries from removal but does not protect cursor objects from being moved around by lseek() operations or freed. The affected code performs list traversals in functions like detach_attrs() and detach_groups() without holding the configfs_dirent_lock spinlock during enumeration. An attacker or malicious process can call lseek() concurrently while these traversals occur, causing cursor pointers to be invalidated, leading to use-after-free conditions. The fix adds proper spinlock protection around list traversals and introduces a next_dirent() helper function that safely finds the next valid entry while holding the lock.
Affected products
- Linux Linux kernel all versions (fix backported across 2.6.11 through 7.2)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Upstream commit 9b9e8bb81c41fd27e7b57a1c936fde140548535f