CVE-2026-64108
Received Received - Intake

Use-After-Free in Linux Kernel CIFS Filesystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs] The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0 Fix it by flushing 'deferredclose_wq' before calling kill_anon_super. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64108
EUVD
EUVD-2026-45793

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel cifs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the CIFS (Common Internet File System) module. When a file is opened and closed, the system schedules a deferred close operation. However, if the CIFS filesystem is unmounted before this deferred operation completes, the dentry (directory entry) reference count remains positive, triggering a kernel warning during unmount. The issue stems from the dentry being held by a file that was already closed but not fully released.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS (Common Internet File System) module and manifests during unmount operations. Detection primarily involves monitoring kernel logs for the warning message: 'BUG: Dentry still in use (1) [unmount of cifs]' during filesystem unmounts. Check kernel logs with 'dmesg | grep -i dentry' or 'journalctl -k | grep -i dentry'.

Impact Analysis

This vulnerability can cause kernel warnings or crashes during filesystem unmount operations, potentially leading to system instability or unexpected behavior. Users may experience filesystem unmount failures or system hangs if the issue occurs during critical operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel filesystem issue related to dentry handling during unmount operations. It may indirectly impact compliance if it causes system instability or data corruption during file operations, but no specific compliance impact is documented.

Mitigation Strategies

Apply the kernel patch that flushes the 'deferredclose_wq' before calling 'kill_anon_super'. Update to a kernel version containing the fix. If immediate patching isn't possible, avoid frequent mounting/unmounting of CIFS shares and monitor for the dentry warning in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart