CVE-2026-74330 (GCVE-0-2026-74330)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45
VLAI
Title
configfs: fix lockless traversals of ->s_children
Summary
In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of ->s_children Having the parent directory locked protects entries from removal by another thread, but it does *not* protect cursors from being moved around by lseek() - or freed, for that matter.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 77fd6f50f633a52c2db061e7d71d8cb486b0265e (git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 91f289728ec706b7ff1ca0ee845dd73ff2253488 (git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb (git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 9e57e2863872e82e7c7237bc32299f67ebebc543 (git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 459860529c109c5ce08b81c0776ca1200eaaeb4a (git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 637ef4961470e04455102b34ac484a34d8eca0a4 (git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < e6d93108e0a27d7e6f95c7e45017d14ba2900d32 (git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 9b9e8bb81c41fd27e7b57a1c936fde140548535f (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.27
Unaffected: 0 , < 2.6.27 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/configfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77fd6f50f633a52c2db061e7d71d8cb486b0265e",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            },
            {
              "lessThan": "91f289728ec706b7ff1ca0ee845dd73ff2253488",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            },
            {
              "lessThan": "b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            },
            {
              "lessThan": "9e57e2863872e82e7c7237bc32299f67ebebc543",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            },
            {
              "lessThan": "459860529c109c5ce08b81c0776ca1200eaaeb4a",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            },
            {
              "lessThan": "637ef4961470e04455102b34ac484a34d8eca0a4",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            },
            {
              "lessThan": "e6d93108e0a27d7e6f95c7e45017d14ba2900d32",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            },
            {
              "lessThan": "9b9e8bb81c41fd27e7b57a1c936fde140548535f",
              "status": "affected",
              "version": "6f61076406251626be39651d114fac412b1e0c39",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/configfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of -\u003es_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local VFS syscalls (openat, getdents, lseek, close, mkdir, rmdir) against configfs, typically mounted at /sys/kernel/config; it is not reachable via network-facing kernel services such as ksmbd, nfsd, or packet-receive paths.\nAC:L - The attacker controls both sides of the race: opening a configfs directory inserts a readdir cursor into s_children, and concurrent lseek() or close() moves or frees that cursor while detach_attrs, detach_groups, or configfs_find_subsys_dentry traverse the list without configfs_dirent_lock; the window is attacker-driven and retryable.\nPR:L - Default configfs trees are root-owned, but 0755 directories let any local user open and lseek while teardown races proceed; USB gadget, target/LIO, gpio-aggregator, and embedded deployments commonly grant configfs mkdir/rmdir/write to service accounts or expose world-writable (S_IWUGO) gadget attributes.\nUI:N - Exploitation requires only the attacker issuing syscalls and spawning concurrent threads against configfs paths mounted at boot; no victim must mount filesystems, click prompts, or open files on the attacker\u0027s behalf.\nS:U - Slab use-after-free and list corruption impact kernel memory within the same security domain; this enables local privilege escalation, not VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Lockless s_children traversal can follow a freed readdir cursor (the fix commit notes cursors can be \"freed\"), dereferencing kmem_cache_freed configfs_dirent objects and yielding standard slab UAF read primitives over adjacent kernel heap contents.\nI:H - The dangling cursor and list corruption enable heap grooming to reclaim freed configfs_dirent slabs and convert the race into arbitrary kernel writes or control-flow hijack, not merely incorrect metadata updates.\nA:H - Concurrent cursor free or move during unlocked list iteration causes kernel oops or panic via invalid list pointers or UAF dereferences; the race is repeatable for sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:56.848Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e"
        },
        {
          "url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488"
        },
        {
          "url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543"
        },
        {
          "url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f"
        }
      ],
      "title": "configfs: fix lockless traversals of -\u003es_children",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74330",
    "datePublished": "2026-08-15T05:58:23.722Z",
    "dateReserved": "2026-08-15T05:44:03.885Z",
    "dateUpdated": "2026-08-17T05:45:56.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74330",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02937"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/configfs/dir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "77fd6f50f633a52c2db061e7d71d8cb486b0265e",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "91f289728ec706b7ff1ca0ee845dd73ff2253488",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9e57e2863872e82e7c7237bc32299f67ebebc543",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "459860529c109c5ce08b81c0776ca1200eaaeb4a",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "637ef4961470e04455102b34ac484a34d8eca0a4",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e6d93108e0a27d7e6f95c7e45017d14ba2900d32",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9b9e8bb81c41fd27e7b57a1c936fde140548535f",
                    "status": "affected",
                    "version": "6f61076406251626be39651d114fac412b1e0c39",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/configfs/dir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.27"
                  },
                  {
                    "lessThan": "2.6.27",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of -\u003es_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter."
          }
        ],
        "id": "CVE-2026-74330",
        "lastModified": "2026-08-17T06:19:27.417",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:33.773",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T11:22:35+00:00",
      "cve": "CVE-2026-74330",
      "id": "CVE-2026-74330",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: configfs: fix lockless traversals of -\u003es_children",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74330.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:22:48Z",
      "cve": "CVE-2026-74330",
      "id": "CVE-2026-74330",
      "initial_release_date": "2026-08-27T16:52:00Z",
      "product_status:known_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74330",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74330.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.