The vulnerability in the Linux kernel configfs_lookup() function arises from improper handling of the ->s_dentry pointer when inode allocation fails. Normally, ->s_dentry is cleared when the dentry it points to becomes negative (evicted). However, if inode allocation fails, the dentry never becomes positive, so the cleanup function d_iput() is not called, leaving ->s_dentry dangling. Subsequent getdents(2) system calls dereference this dangling pointer, causing a use-after-free condition. The minimal fix clears ->s_dentry on failure to prevent this. The root cause is a longstanding bug dating back to 2006 related to the timing of setting the linkage between dentry and configfs_dirent.

This vulnerability can lead to use-after-free memory access in the Linux kernel when reading directory entries via getdents(2) in configfs. Such memory corruption could potentially cause kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems using the affected configfs code path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is in the Linux kernel, monitor official Linux kernel release notes and security advisories for the fix. Until patched, avoid untrusted use of configfs features that trigger this code path if possible.