$ the-wire · showcase
configfs symlink race fixes land for 7.3-rc3
By RepoJournal · Filed · About Linux
Kernel 7.3-rc3 pulls in configfs fixes for a symlink-rmdir race that could hit freed memory, while omarchy hardens sudo expiry and adapts to Arch's dropped broadcom-wl package.
The configfs fixes merged for 7.3-rc3 ship two commits that close a use-after-free race between symlink resolution and rmdir of the target [1]. The root cause is that the reference taken by configfs_get_config_item() pins the config_item, not its dentry; the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() drops before the item dies [2]. create_link() then chases ->ci_dentry into freed memory. The fix takes the target's configfs_dirent under ->d_lock instead [2], and configfs_rmdir() now unhashes the dentry before dropping the item, closing the window where a hashed dentry points to a dead item [3]. This is a fix for a kernel crash, not a user-visible API change.
Two perf tools fixes also came in: Intel PT decoding no longer uses separate debug files, and the PowerPC VPA DTL sample raw size is corrected [4]. These affect perf trace output correctness on those paths.
Elsewhere, omarchy merged a fail-closed change for passwordless sudo expiry [5]. Previously, the unrestricted sudoers grant could be live before systemd-run armed its expiry timer, a fail-open window; the change removes stale grants during early boot and revokes the grant if arming cannot complete [5]. This is a security hardening. A separate merge restricts third-party plugin access to authentication services [6], narrowing the attack surface for plugin code.
Omarchy also switched its Broadcom wireless support to broadcom-wl-dkms, because Arch removed the prebuilt broadcom-wl package on 2026-09-02 [7]. The rebuilt package declares replaces=(broadcom-wl), but a replaces entry only covers upgrades, so the old name is unresolvable as an explicit pacman target, which broke the offline ISO mirror download with "target not found: broadcom-wl" [7]. Explicit dkms is now redundant since broadcom-wl-dkms pulls it in [7].
Action items
- → Pull 7.3-rc3 or cherry-pick the two configfs commits if your tree uses symlinks under configfs torvalds/linux [immediate]
- → Upgrade omarchy to include the fail-closed sudo expiry and plugin auth boundary changes basecamp/omarchy [immediate]
- → For Arch installs, use broadcom-wl-dkms instead of broadcom-wl in any scripted install basecamp/omarchy [plan]
References
- [1] Merge tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux ↗ torvalds/linux
- [2] configfs: pin the symlink target's dirent instead of chasing ->ci_dentry ↗ torvalds/linux
- [3] configfs: unhash the dentry before dropping the item in rmdir ↗ torvalds/linux
- [4] Merge tag 'perf-tools-fixes-for-v7.3-2026-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools ↗ torvalds/linux
- [5] Fail closed when passwordless sudo expiry cannot arm ↗ basecamp/omarchy
- [6] Merge pull request #9618 from acrogenesis/security/plugin-auth-boundary ↗ basecamp/omarchy
- [7] Install broadcom-wl-dkms now that Arch dropped the prebuilt module ↗ basecamp/omarchy
