{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74330", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.885Z", "datePublished": "2026-08-15T05:58:23.722Z", "dateUpdated": "2026-08-17T05:45:56.848Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:56.848Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of ->s_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local VFS syscalls (openat, getdents, lseek, close, mkdir, rmdir) against configfs, typically mounted at /sys/kernel/config; it is not reachable via network-facing kernel services such as ksmbd, nfsd, or packet-receive paths.\nAC:L - The attacker controls both sides of the race: opening a configfs directory inserts a readdir cursor into s_children, and concurrent lseek() or close() moves or frees that cursor while detach_attrs, detach_groups, or configfs_find_subsys_dentry traverse the list without configfs_dirent_lock; the window is attacker-driven and retryable.\nPR:L - Default configfs trees are root-owned, but 0755 directories let any local user open and lseek while teardown races proceed; USB gadget, target/LIO, gpio-aggregator, and embedded deployments commonly grant configfs mkdir/rmdir/write to service accounts or expose world-writable (S_IWUGO) gadget attributes.\nUI:N - Exploitation requires only the attacker issuing syscalls and spawning concurrent threads against configfs paths mounted at boot; no victim must mount filesystems, click prompts, or open files on the attacker's behalf.\nS:U - Slab use-after-free and list corruption impact kernel memory within the same security domain; this enables local privilege escalation, not VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Lockless s_children traversal can follow a freed readdir cursor (the fix commit notes cursors can be \"freed\"), dereferencing kmem_cache_freed configfs_dirent objects and yielding standard slab UAF read primitives over adjacent kernel heap contents.\nI:H - The dangling cursor and list corruption enable heap grooming to reclaim freed configfs_dirent slabs and convert the race into arbitrary kernel writes or control-flow hijack, not merely incorrect metadata updates.\nA:H - Concurrent cursor free or move during unlocked list iteration causes kernel oops or panic via invalid list pointers or UAF dereferences; the race is repeatable for sustained denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/configfs/dir.c"], "versions": [{"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "77fd6f50f633a52c2db061e7d71d8cb486b0265e", "status": "affected", "versionType": "git"}, {"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "91f289728ec706b7ff1ca0ee845dd73ff2253488", "status": "affected", "versionType": "git"}, {"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb", "status": "affected", "versionType": "git"}, {"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "9e57e2863872e82e7c7237bc32299f67ebebc543", "status": "affected", "versionType": "git"}, {"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "459860529c109c5ce08b81c0776ca1200eaaeb4a", "status": "affected", "versionType": "git"}, {"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "637ef4961470e04455102b34ac484a34d8eca0a4", "status": "affected", "versionType": "git"}, {"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "e6d93108e0a27d7e6f95c7e45017d14ba2900d32", "status": "affected", "versionType": "git"}, {"version": "6f61076406251626be39651d114fac412b1e0c39", "lessThan": "9b9e8bb81c41fd27e7b57a1c936fde140548535f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/configfs/dir.c"], "versions": [{"version": "2.6.27", "status": "affected"}, {"version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e"}, {"url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488"}, {"url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb"}, {"url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543"}, {"url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a"}, {"url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4"}, {"url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32"}, {"url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f"}], "title": "configfs: fix lockless traversals of ->s_children", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/configfs/dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "77fd6f50f633a52c2db061e7d71d8cb486b0265e", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}, {"lessThan": "91f289728ec706b7ff1ca0ee845dd73ff2253488", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}, {"lessThan": "b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}, {"lessThan": "9e57e2863872e82e7c7237bc32299f67ebebc543", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}, {"lessThan": "459860529c109c5ce08b81c0776ca1200eaaeb4a", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}, {"lessThan": "637ef4961470e04455102b34ac484a34d8eca0a4", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}, {"lessThan": "e6d93108e0a27d7e6f95c7e45017d14ba2900d32", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}, {"lessThan": "9b9e8bb81c41fd27e7b57a1c936fde140548535f", "status": "affected", "version": "6f61076406251626be39651d114fac412b1e0c39", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/configfs/dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of ->s_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter."}], "id": "CVE-2026-74330", "lastModified": "2026-08-17T06:19:27.417", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:33.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: configfs: fix lockless traversals of ->s_children", "id": "2516824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516824"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's configfs component. This vulnerability arises from improper handling of directory traversals, where cursors can be unexpectedly moved or freed by another process even when the parent directory is locked. This lack of proper synchronization can lead to an inconsistent system state, potentially causing system instability or data corruption."], "name": "CVE-2026-74330", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74330\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74330\nhttps://lore.kernel.org/linux-cve-announce/2026081555-CVE-2026-74330-c5e9@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,77fd6f50f633a52c2db061e7d71d8cb486b0265e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,91f289728ec706b7ff1ca0ee845dd73ff2253488)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,9e57e2863872e82e7c7237bc32299f67ebebc543)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,459860529c109c5ce08b81c0776ca1200eaaeb4a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,637ef4961470e04455102b34ac484a34d8eca0a4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,e6d93108e0a27d7e6f95c7e45017d14ba2900d32)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f61076406251626be39651d114fac412b1e0c39,9b9e8bb81c41fd27e7b57a1c936fde140548535f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.27"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.27)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T16:45:10.768924+00:00", "updated": "2026-08-22T00:15:05.518264+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-367"]}