An incorrect handling of directory entries in the Linux kernel’s configfs subsystem causes a race between link creation and removal. The bug arises because create_link() pins the symlink target's dentry via a reference counted struct but does not pin the underlying dentry object, leading to a use‑after‑free of a dentry during a configfs lookup. Based on the description, it is inferred that an attacker controlling configfs objects could trigger a kernel fault by concurrently creating and deleting a symlink to a target that is being accessed, potentially allowing memory corruption or privilege escalation.

The vulnerability affects all versions of the Linux kernel that include a configfs build before the patch was applied, as identified by the kernel CPE string. No specific vendor or version is listed, so any Linux system running an unpatched kernel that enables the configfs filesystem is potentially susceptible.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of < 1% suggests that exploitation is unlikely. The flaw is not listed in the CISA KEV catalog, meaning no known widespread exploitation. Exploitation would most likely require local access to the configfs filesystem, typically constrained to root or privileged users, and would involve a race condition between link creation and removal.