EUVD-2026-59477
GHSA-x69c-vj2q-h6ch
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires precise concurrent syscall timing, warranting AC:H over the provided AC:L; all other metrics match the vendor vector.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix lockless traversals of ->s_children
Having the parent directory locked protects entries from removal by another thread, but it does *not* protect cursors from being moved around by lseek() - or freed, for that matter.
AnalysisAI
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged local user account with shell access on the target system (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly identifies local access and low-privilege prerequisites but rates attack complexity as Low, which appears optimistic for a race condition that requires precise timing alignment between concurrent syscall threads - this metric warrants scrutiny when operationally triaging the finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user spawns two threads sharing an open file descriptor on a configfs directory: one thread repeatedly calls getdents64() to iterate directory entries while the second thread simultaneously calls lseek() to reposition the read offset. The concurrent lseek() triggers cursor movement or deallocation while the first thread still holds a pointer to it, causing a use-after-free dereference in kernel context. … |
| Remediation | Apply the vendor-released kernel patches by upgrading to the fixed version for the applicable stable branch: 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, or 5.10.261. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Linux systems in your environment and document kernel versions against the affected list (versions before 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, or 5.10.261). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today