CVE-2026-74330

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only through local VFS syscalls (openat, getdents, lseek, close, mkdir, rmdir) against configfs, typically mounted at /sys/kernel/config; it is not reachable via network-facing kernel services such as ksmbd, nfsd, or packet-receive paths.

AC:LAttack complexity, low

The attacker controls both sides of the race: opening a configfs directory inserts a readdir cursor into s_children, and concurrent lseek() or close() moves or frees that cursor while detach_attrs, detach_groups, or configfs_find_subsys_dentry traverse the list without configfs_dirent_lock; the window is attacker-driven and retryable.

PR:LPrivileges required, low

Default configfs trees are root-owned, but 0755 directories let any local user open and lseek while teardown races proceed; USB gadget, target/LIO, gpio-aggregator, and embedded deployments commonly grant configfs mkdir/rmdir/write to service accounts or expose world-writable (S_IWUGO) gadget attributes.

UI:NUser interaction, none

Exploitation requires only the attacker issuing syscalls and spawning concurrent threads against configfs paths mounted at boot; no victim must mount filesystems, click prompts, or open files on the attacker's behalf.

S:UScope, unchanged

Slab use-after-free and list corruption impact kernel memory within the same security domain; this enables local privilege escalation, not VM escape, IOMMU bypass, or sandbox boundary crossing.

C:HConfidentiality impact, high

Lockless s_children traversal can follow a freed readdir cursor (the fix commit notes cursors can be "freed"), dereferencing kmem_cache_freed configfs_dirent objects and yielding standard slab UAF read primitives over adjacent kernel heap contents.

I:HIntegrity impact, high

The dangling cursor and list corruption enable heap grooming to reclaim freed configfs_dirent slabs and convert the race into arbitrary kernel writes or control-flow hijack, not merely incorrect metadata updates.

A:HAvailability impact, high

Concurrent cursor free or move during unlocked list iteration causes kernel oops or panic via invalid list pointers or UAF dereferences; the race is repeatable for sustained denial of service.