CVE-2026-64040

Analyzed Analyzed - Analysis Complete

cachefiles: Fix mkdir Error Handling in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-10-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfs_mkdir() fails When vfs_mkdir() fails, the error code is not extracted from the returned error pointer. This causes mkdir_error to be reached with ret=0, which leads to returning ERR_PTR(0) (NULL) instead of a proper error pointer. Fix this by extracting the error code from the error pointer when vfs_mkdir() fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-06

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-64040

EUVD

EUVD-2026-45613

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.15 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where vfs_mkdir() fails to properly return an error code. When vfs_mkdir() fails, the error pointer is not checked for the actual error, causing the function to return ERR_PTR(0) (NULL) instead of a meaningful error. This leads to incorrect error handling in the cachefiles component.

Detection Guidance

This vulnerability is specific to the Linux kernel's cachefiles functionality and does not have direct network detection methods. Check kernel logs for errors related to vfs_mkdir() failures in cachefiles operations. Commands like dmesg | grep cachefiles or journalctl -k | grep cachefiles may help identify issues.

Impact Analysis

This vulnerability may cause filesystem operations to fail silently or behave unexpectedly when directory creation fails. It could lead to data corruption, application crashes, or denial of service in systems relying on cachefiles functionality.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel filesystem error handling issue. Compliance impacts would depend on how the affected system is used in a broader context rather than this specific bug.

Mitigation Strategies

Update the Linux kernel to the latest patched version where this issue is resolved. Monitor system logs for cachefiles-related errors and ensure no critical services depend on the affected functionality until patched.

Hi! I’m here to help you understand CVE-2026-64040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70