Linux Kernel EUVD-2026-45870

The vulnerability resides in the Linux kernel's sysfs virtual filesystem layer, which delegates its on-disk (tmpfs-backed) operations to the kernfs subsystem. The affected code path is internal_create_group(), invoked via sysfs_update_group() to refresh named attribute groups exposed to userspace under /sys. When create_files() fails midway (e.g., due to -ENOMEM), the cleanup branch unconditionally calls kernfs_remove(kn), destroying the group directory. In the update path, kn was retrieved via kernfs_find_and_get() - a lookup of an existing directory - rather than freshly allocated; the code did not track whether it was responsible for directory creation, causing it to delete state it did not own. The fix conditions the kernfs_remove() call on whether the directory was created by the current invocation. No formal CWE is assigned, but the root cause class maps closely to CWE-459 (Incomplete Cleanup) or CWE-672 (Operation on a Resource after Expiration or Release). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.