{"id":"CVE-2026-74359","title":"configfs_lookup(): don't leave ->s_dentry dangling on failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs_lookup(): don't leave ->s_dentry dangling on failure\n\nNormally ->s_dentry is cleared when dentry it's pointing to becomes\nnegative (on eviction, realistically)…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 3e83b2203aa59bd279e4f677ec793d49dc9d019e","Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < b6e9c82522ddaa3ac0706b295ff4a71975d4f883","Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < eee07d769da5ac4e4f7bd0bc17828646a318d499","Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 9c747dcee164ead300de90550ad9e4122f0d1bbb","Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < c3b073a209a9baa691b744318ac929fecdd8847c","Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 57088b06109f3222963c639d8d743f42c2899b13","Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 10da12d352b7b2bb330a8609fdda9a58bf0e9856","Linux 2.6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:54:26.470078Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:35.328Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74359","references":[{"url":"https://git.kernel.org/stable/c/3e83b2203aa59bd279e4f677ec793d49dc9d019e"},{"url":"https://git.kernel.org/stable/c/b6e9c82522ddaa3ac0706b295ff4a71975d4f883"},{"url":"https://git.kernel.org/stable/c/eee07d769da5ac4e4f7bd0bc17828646a318d499"},{"url":"https://git.kernel.org/stable/c/9c747dcee164ead300de90550ad9e4122f0d1bbb"},{"url":"https://git.kernel.org/stable/c/c3b073a209a9baa691b744318ac929fecdd8847c"},{"url":"https://git.kernel.org/stable/c/57088b06109f3222963c639d8d743f42c2899b13"},{"url":"https://git.kernel.org/stable/c/10da12d352b7b2bb330a8609fdda9a58bf0e9856"}],"tags":["cve.org"],"epss":0.00171,"epssPercentile":0.06039,"ingestedAt":"2026-10-16T19:46:24.374Z","slug":"CVE-2026-74359","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs_lookup(): don't leave ->s_dentry dangling on failure\n\nNormally ->s_dentry is cleared when dentry it's pointing to becomes\nnegative (on eviction, realistically).  However, that only happens\nif dentry gets to be positive in the first place; in case of inode\nallocation failure dentry never becomes positive, so ->d_iput()\nis not called at all.\n\nWe do part of what normally would've been done by configfs_d_iput()\n(dropping the reference to configfs_dirent) manually, but we do\nnot clear ->s_dentry there.  Sloppy as it is, it does not matter in\ncase of configfs_create_{dir,link}() - there configfs_dirent does\nnot survive dropping the sole reference to it.\n\nHowever, for configfs_lookup() it *does* survive, with a dangling\npointer to soon to be freed dentry sitting it its ->s_dentry.\n\nSubsequent getdents(2) in that directory will end up dereferencing\nthat pointer in order to pick the inode number.  Use after free...\n\nThis is the minimal fix; the right approach is to set the linkage\nbetween dentry and configfs_dirent only after we know that we have\nan inode, but that takes more surgery and the bug had been there\nsince 2006, so...\n\n## Affected\n\n- `Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 3e83b2203aa59bd279e4f677ec793d49dc9d019e`\n- `Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < b6e9c82522ddaa3ac0706b295ff4a71975d4f883`\n- `Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < eee07d769da5ac4e4f7bd0bc17828646a318d499`\n- `Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 9c747dcee164ead300de90550ad9e4122f0d1bbb`\n- `Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < c3b073a209a9baa691b744318ac929fecdd8847c`\n- `Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 57088b06109f3222963c639d8d743f42c2899b13`\n- `Linux >= 3d0f89bb169482d26d5aa4e82e763077e7e9bc4d < 10da12d352b7b2bb330a8609fdda9a58bf0e9856`\n- `Linux 2.6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}