CVE-2026-74330 (GCVE-0-2026-74330)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-10-16 18:55
VLAI
EPSS
VEX
Title
configfs: fix lockless traversals of ->s_children
Summary
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix lockless traversals of ->s_children
Having the parent directory locked protects entries from removal
by another thread, but it does *not* protect cursors from being
moved around by lseek() - or freed, for that matter.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:53 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
6f61076406251626be39651d114fac412b1e0c39 , < 77fd6f50f633a52c2db061e7d71d8cb486b0265e
(git)
Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 91f289728ec706b7ff1ca0ee845dd73ff2253488 (git) Affected: 6f61076406251626be39651d114fac412b1e0c39 , < b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb (git) Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 9e57e2863872e82e7c7237bc32299f67ebebc543 (git) Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 459860529c109c5ce08b81c0776ca1200eaaeb4a (git) Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 637ef4961470e04455102b34ac484a34d8eca0a4 (git) Affected: 6f61076406251626be39651d114fac412b1e0c39 , < e6d93108e0a27d7e6f95c7e45017d14ba2900d32 (git) Affected: 6f61076406251626be39651d114fac412b1e0c39 , < 9b9e8bb81c41fd27e7b57a1c936fde140548535f (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.27
Unaffected: 0 , < 2.6.27 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:53:38.426729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:33.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "77fd6f50f633a52c2db061e7d71d8cb486b0265e",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "91f289728ec706b7ff1ca0ee845dd73ff2253488",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "9e57e2863872e82e7c7237bc32299f67ebebc543",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "459860529c109c5ce08b81c0776ca1200eaaeb4a",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "637ef4961470e04455102b34ac484a34d8eca0a4",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "e6d93108e0a27d7e6f95c7e45017d14ba2900d32",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "9b9e8bb81c41fd27e7b57a1c936fde140548535f",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of -\u003es_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local VFS syscalls (openat, getdents, lseek, close, mkdir, rmdir) against configfs, typically mounted at /sys/kernel/config; it is not reachable via network-facing kernel services such as ksmbd, nfsd, or packet-receive paths.\nAC:L - The attacker controls both sides of the race: opening a configfs directory inserts a readdir cursor into s_children, and concurrent lseek() or close() moves or frees that cursor while detach_attrs, detach_groups, or configfs_find_subsys_dentry traverse the list without configfs_dirent_lock; the window is attacker-driven and retryable.\nPR:L - Default configfs trees are root-owned, but 0755 directories let any local user open and lseek while teardown races proceed; USB gadget, target/LIO, gpio-aggregator, and embedded deployments commonly grant configfs mkdir/rmdir/write to service accounts or expose world-writable (S_IWUGO) gadget attributes.\nUI:N - Exploitation requires only the attacker issuing syscalls and spawning concurrent threads against configfs paths mounted at boot; no victim must mount filesystems, click prompts, or open files on the attacker\u0027s behalf.\nS:U - Slab use-after-free and list corruption impact kernel memory within the same security domain; this enables local privilege escalation, not VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Lockless s_children traversal can follow a freed readdir cursor (the fix commit notes cursors can be \"freed\"), dereferencing kmem_cache_freed configfs_dirent objects and yielding standard slab UAF read primitives over adjacent kernel heap contents.\nI:H - The dangling cursor and list corruption enable heap grooming to reclaim freed configfs_dirent slabs and convert the race into arbitrary kernel writes or control-flow hijack, not merely incorrect metadata updates.\nA:H - Concurrent cursor free or move during unlocked list iteration causes kernel oops or panic via invalid list pointers or UAF dereferences; the race is repeatable for sustained denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:56.848Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e"
},
{
"url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488"
},
{
"url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb"
},
{
"url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543"
},
{
"url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a"
},
{
"url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4"
},
{
"url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32"
},
{
"url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f"
}
],
"title": "configfs: fix lockless traversals of -\u003es_children",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74330",
"datePublished": "2026-08-15T05:58:23.722Z",
"dateReserved": "2026-08-15T05:44:03.885Z",
"dateUpdated": "2026-10-16T18:55:33.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74330",
"date": "2026-10-20",
"epss": "0.00129",
"percentile": "0.02297"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "77fd6f50f633a52c2db061e7d71d8cb486b0265e",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "91f289728ec706b7ff1ca0ee845dd73ff2253488",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "9e57e2863872e82e7c7237bc32299f67ebebc543",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "459860529c109c5ce08b81c0776ca1200eaaeb4a",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "637ef4961470e04455102b34ac484a34d8eca0a4",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "e6d93108e0a27d7e6f95c7e45017d14ba2900d32",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "9b9e8bb81c41fd27e7b57a1c936fde140548535f",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of -\u003es_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter."
}
],
"id": "CVE-2026-74330",
"lastModified": "2026-10-16T19:17:39.690",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74330",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:53:38.426729Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-15T06:22:33.773",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-16T23:15:30+00:00",
"cve": "CVE-2026-74330",
"id": "CVE-2026-74330",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "275",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: configfs: fix lockless traversals of -\u003es_children",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74330.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:53:38.426729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:53:39.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "77fd6f50f633a52c2db061e7d71d8cb486b0265e",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "91f289728ec706b7ff1ca0ee845dd73ff2253488",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "9e57e2863872e82e7c7237bc32299f67ebebc543",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "459860529c109c5ce08b81c0776ca1200eaaeb4a",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "637ef4961470e04455102b34ac484a34d8eca0a4",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "e6d93108e0a27d7e6f95c7e45017d14ba2900d32",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
},
{
"lessThan": "9b9e8bb81c41fd27e7b57a1c936fde140548535f",
"status": "affected",
"version": "6f61076406251626be39651d114fac412b1e0c39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of -\u003es_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local VFS syscalls (openat, getdents, lseek, close, mkdir, rmdir) against configfs, typically mounted at /sys/kernel/config; it is not reachable via network-facing kernel services such as ksmbd, nfsd, or packet-receive paths.\nAC:L - The attacker controls both sides of the race: opening a configfs directory inserts a readdir cursor into s_children, and concurrent lseek() or close() moves or frees that cursor while detach_attrs, detach_groups, or configfs_find_subsys_dentry traverse the list without configfs_dirent_lock; the window is attacker-driven and retryable.\nPR:L - Default configfs trees are root-owned, but 0755 directories let any local user open and lseek while teardown races proceed; USB gadget, target/LIO, gpio-aggregator, and embedded deployments commonly grant configfs mkdir/rmdir/write to service accounts or expose world-writable (S_IWUGO) gadget attributes.\nUI:N - Exploitation requires only the attacker issuing syscalls and spawning concurrent threads against configfs paths mounted at boot; no victim must mount filesystems, click prompts, or open files on the attacker\u0027s behalf.\nS:U - Slab use-after-free and list corruption impact kernel memory within the same security domain; this enables local privilege escalation, not VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Lockless s_children traversal can follow a freed readdir cursor (the fix commit notes cursors can be \"freed\"), dereferencing kmem_cache_freed configfs_dirent objects and yielding standard slab UAF read primitives over adjacent kernel heap contents.\nI:H - The dangling cursor and list corruption enable heap grooming to reclaim freed configfs_dirent slabs and convert the race into arbitrary kernel writes or control-flow hijack, not merely incorrect metadata updates.\nA:H - Concurrent cursor free or move during unlocked list iteration causes kernel oops or panic via invalid list pointers or UAF dereferences; the race is repeatable for sustained denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:56.848Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e"
},
{
"url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488"
},
{
"url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb"
},
{
"url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543"
},
{
"url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a"
},
{
"url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4"
},
{
"url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32"
},
{
"url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f"
}
],
"title": "configfs: fix lockless traversals of -\u003es_children",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74330",
"datePublished": "2026-08-15T05:58:23.722Z",
"dateReserved": "2026-08-15T05:44:03.885Z",
"dateUpdated": "2026-10-16T18:55:33.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.