CVE-2026-74330
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the configfs filesystem has an issue with lockless traversals of ->s_children. Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek() or freed.
Risk Assessment
Unsafe operations on the children list can lead to data integrity issues or system crashes when working with configfs.
Recommendation
Apply the kernel patch that ensures proper synchronization of access to the children list in configfs.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of ->s_children Having the parent directory locked protects entries from removal by another thread, but it does *not* protect cursors from being moved around by lseek() - or freed, for that matter.