Linux Kernel: Config FS Race Condition Fixes
Two syzbot-discovered use-after-free bugs in configfs symlink handling have been patched, closing a race between symlink creation and directory removal. A smaller set of perf tool fixes for Intel PT and PowerPC tracing also landed.
Duration: PT2M29S
Episode overview
This episode is a short developer briefing from Linux Kernel.
It explains recent repository work in plain language.
- Show: Linux Kernel
- Published: 2026-09-08T13:15:50Z
- Audio duration: PT2M29S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's September 8th, 2026, and this is your Linux Kernel briefing.
Today's main story is a pair of security-relevant fixes in configfs, the kernel's user-driven configuration filesystem. Both were found by syzbot, and both stem from the same root problem: a symlink operation racing against directory removal on its target.
Here's the mechanics, in plain terms. When you create a symlink to a config item, the kernel takes a reference to keep that item alive. But that reference doesn't protect the item's dentry — its filesystem directory entry. The dentry gets released separately during removal, in a window where the item itself is still…
Vasileios Almpanis fixed this from two angles. Commit a7c1290 changes how the code fetches the target's internal directory entry — instead of chasing a pointer that might already be dangling, it now pins the entry directly, atomically with the item reference. Commit f06c2d2 closes a second angle: the…
For anyone working with configfs or debugging similar symlink-versus-teardown races elsewhere in the kernel, the pattern here is worth remembering: don't assume a reference to a data structure implies a live reference to its associated…
Separate…
Nearby episodes from Linux Kernel
- A Merge Window Full of Race Conditions
- Weekly Recap - Stabilizing the 7.3 Merge Window
- Late-Cycle Fixes Converge on Storage and Security
- Late-Cycle Fixes Converge on Memory Safety
- A Stable Cycle of Memory and Subsystem Hardening
- Randstruct and Rust Compatibility Fix
- SMB Stack Gets a Security and Corruption Sweep
- Race Conditions Take Center Stage in RC Fixes