An incorrect handling of directory entries in the Linux kernel’s configfs subsystem can cause a reference count race that releases a dentry while it is still referenced by a symlink target. This leads to a use‑after‑free during a configfs lookup, allowing an attacker to trigger a kernel fault that can be leveraged for privilege escalation on systems where the attacker can manipulate configfs objects.

The vulnerability affects all Linux kernel releases prior to the fix, as identified by the kernel CPE. No specific vendor version information is supplied, but the issue exists in any unpatched copy of the Linux kernel.

The lack of an EPSS score means the exploitation likelihood cannot be quantified, and KEV indicates the vulnerability is not currently listed as a widely‑exploited flaw. However, because the flaw occurs at kernel level and involves an unchecked use‑after‑free, it presents a high severity risk. The attack likely requires local access to create configuration files or symlinks in configfs, which is normally restricted to the root or privileged users. An attacker who can influence configfs object creation and deletion could exploit the race to crash the kernel or gain elevated privileges.