EUVD-2026-59506
GHSA-w2rw-4pc9-v672
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges suffices; no user interaction; UAF in kernel yields full C/I/A impact; scope unchanged as exploit stays within the kernel.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
configfs_lookup(): don't leave ->s_dentry dangling on failure
Normally ->s_dentry is cleared when dentry it's pointing to becomes negative (on eviction, realistically). However, that only happens if dentry gets to be positive in the first place; in case of inode allocation failure dentry never becomes positive, so ->d_iput() is not called at all.
We do part of what normally would've been done by configfs_d_iput() (dropping the reference to configfs_dirent) manually, but we do not clear ->s_dentry there. Sloppy as it is, it does not matter in case of configfs_create_{dir,link}() - there configfs_dirent does not survive dropping the sole reference to it.
However, for configfs_lookup() it *does* survive, with a dangling pointer to soon to be freed dentry sitting it its ->s_dentry.
Subsequent getdents(2) in that directory will end up dereferencing that pointer in order to pick the inode number. Use after free...
This is the minimal fix; the right approach is to set the linkage between dentry and configfs_dirent only after we know that we have an inode, but that takes more surgery and the bug had been there since 2006, so...
AnalysisAI
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a local user account with at least low privileges on the target system (PR:L per CVSS - unauthenticated remote exploitation is not possible); (2) the kernel compiled with CONFIG_CONFIGFS_FS enabled and configfs mounted and accessible to the attacking user (standard on most Linux distributions at /sys/kernel/config); (3) the ability to induce an inode allocation failure within a configfs directory, which requires engineering memory pressure on the system - this is within an attacker's control but adds practical complexity; (4) the running kernel version must predate the fix commits (older than 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 respectively). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) appropriately captures a local, low-privilege kernel UAF with theoretical full impact on confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a low-privilege shell account on a Linux system that has configfs mounted allocates memory aggressively to induce inode allocation failure during a lookup in an accessible configfs directory, then immediately calls getdents(2) on that directory before the freed dentry memory is reused. The kernel dereferences the dangling ->s_dentry pointer to read the inode number, corrupting or disclosing kernel heap memory; with careful heap grooming this primitive could be extended to arbitrary kernel code execution, though this has not been demonstrated publicly and no proof-of-concept is known at time of analysis. |
| Remediation | The primary fix is to upgrade to a patched kernel: 5.15.212 (LTS), 6.1.178 (LTS), 6.6.145 (LTS), 6.12.97 (LTS), 6.18.40, 7.1.5, or 7.2-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems in the environment and identify those running vulnerable kernel versions prior to the CVE-2026-74359 patch release. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today