In the Linux kernel, an error in configfs_lookup() can leave a dangling pointer to a dentry when inode allocation fails. The pointer is later dereferenced during getdents() calls, resulting in a use‑after‑free condition that may corrupt kernel memory. The vulnerability stems from the failure to clear the s_dentry field after a failed lookup, allowing an attacker with the ability to trigger the scenario to cause arbitrary memory corruption, potentially leading to privilege escalation or denial of service.

The flaw is present in all releases of the Linux kernel that have not incorporated the fixes referenced in the upstream commit. The affected product is the Linux kernel itself; any distribution packaging a kernel before the patch that modifies the configfs_lookup() logic is at risk. No specific version range is listed, so all pre‑hotfix kernels are considered vulnerable.

The CVSS score is 7.8, indicating a high severity. The EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local access capable of performing getdents() on a configfs directory where an inode allocation fails, which is unlikely in normal operation but could be triggered by a crafted device or a misconfigured system. Because the fault can corrupt kernel memory, the risk is significant for impacted systems.