EUVD-2026-59477
GHSA-x69c-vj2q-h6ch
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires precise concurrent syscall timing, warranting AC:H over the provided AC:L; all other metrics match the vendor vector.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix lockless traversals of ->s_children
Having the parent directory locked protects entries from removal by another thread, but it does *not* protect cursors from being moved around by lseek() - or freed, for that matter.
AnalysisAI
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged local user account with shell access on the target system (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly identifies local access and low-privilege prerequisites but rates attack complexity as Low, which appears optimistic for a race condition that requires precise timing alignment between concurrent syscall threads - this metric warrants scrutiny when operationally triaging the finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patches by upgrading to the fixed version for the applicable stable branch: 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, or 5.10.261. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Linux systems in your environment and document kernel versions against the affected list (versions before 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, or 5.10.261). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today