Linux Kernel Daily: Configfs Use-After-Free Fixes
A pair of syzbot-found race conditions in configfs's symlink and directory removal code have been fixed, closing a window where a symlink operation could dereference freed memory during a concurrent rmdir. Perf tools also picked up two small fixes for Intel PT decoding and PowerPC trace samples.
Duration: PT2M16S
Episode overview
This episode is a short developer briefing from Linux Kernel Daily.
It explains recent repository work in plain language.
- Show: Linux Kernel Daily
- Published: 2026-09-08T06:02:14Z
- Audio duration: PT2M16S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's September 8th, 2026, and this is Linux Kernel Daily.
Today's clear signal comes out of configfs, where two related race conditions were closed after being caught by syzbot. Both bugs live at the intersection of symlink creation and directory removal, and both stem from the same root cause: code that trusted a dentry's state as proof that the underlying config item was…
In commit f06c2d2, Vasileios Almpanis fixed a case where configfs remove-directory left a dentry hashed even after the item behind it was freed. Since configfs's own lookup function treats a hashed dentry as evidence of a live item, a symlink operation could race in during that window and hit a use-after-free. The…
The companion fix, in commit a7c1290, tackles a related path: symlink creation was reading target data through a pointer that gets freed by remove-directory before the item itself is gone. The fix now pins the target's internal directory-entry structure directly, under a lock, at the same time it takes the item…
Both patches were merged together by Breno Leitao in tag configfs-7.3-rc3, and Linus pulled that into mainline as commit c297ed9. The takeaway for anyone touching configfs or…
Separa…
Nearby episodes from Linux Kernel Daily
- Weekly Recap - Correctness Fixes Across Subsystems
- Merge Window Cleanup Across Subsystems
- Race Conditions and Rushed Requests
- The Merge Window Cleanup
- Merge Window Cleanup and a Memory Accounting Bug Fix
- Randstruct Settles Down for Rust Builds
- SMB Stack Gets a Security Overhaul
- Race Condition Cleanup Across Cgroups, Workqueues, and EDAC