{"apiVersion":"1.0","identifier":"CVE-2026-74359","description":"In the Linux kernel, the following vulnerability has been resolved: configfs_lookup(): don-t leave ->s_dentry dangling on failure Normally ->s_dentry is cleared when dentry it-s pointing to becomes negative (on eviction, realistically). However, that only happens if dentry gets to be positive in the first place; in case of inode allocation failure dentry never becomes positive, so ->d_iput() is not called at all. We do part of what normally would-ve been done by configfs_d_iput() (dropping the reference to configfs_dirent) manually, but we do not clear ->s_dentry there. Sloppy as it is, it does not matter in case of configfs_create_{dir,link}() - there configfs_dirent does not survive dropping the sole reference to it. However, for configfs_lookup() it *does* survive, with a dangling pointer to soon to be freed dentry sitting it its ->s_dentry. Subsequent getdents(2) in that directory will end up dereferencing that pointer in order to pick the inode number. Use after free... This is the minimal fix; the right approach is to set the linkage between dentry and configfs_dirent only after we know that we have an inode, but that takes more surgery and the bug had been there since 2006, so...","publishedAt":"2026-08-15T06:22:37","lastModifiedAt":"2026-08-17T06:19:30","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74359","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00126,"riskScore":0.79,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74359","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74359","en":"https://www.redsauce.net/en/cves/CVE-2026-74359","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74359","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74359","de":"https://www.redsauce.net/de/cves/CVE-2026-74359","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74359","el":"https://www.redsauce.net/el/cves/CVE-2026-74359"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74359"}}