CVE-2026-64108

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel CIFS Filesystem

Publication date: 2026-07-19

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs] The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0 Fix it by flushing 'deferredclose_wq' before calling kill_anon_super. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-12

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64108

EUVD

EUVD-2026-45793

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.0
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.1.167 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.12.78 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.18.20 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19.10 (inc) to 7.0 (exc)
linux	linux_kernel	From 6.6.130 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 7.0.1 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the CIFS (Common Internet File System) module. When a file is opened and closed, the system schedules a deferred close operation. However, if the CIFS filesystem is unmounted before this deferred operation completes, the dentry (directory entry) reference count remains positive, triggering a kernel warning during unmount. The issue stems from the dentry being held by a file that was already closed but not fully released.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS (Common Internet File System) module and manifests during unmount operations. Detection primarily involves monitoring kernel logs for the warning message: 'BUG: Dentry still in use (1) [unmount of cifs]' during filesystem unmounts. Check kernel logs with 'dmesg | grep -i dentry' or 'journalctl -k | grep -i dentry'.

Impact Analysis

This vulnerability can cause kernel warnings or crashes during filesystem unmount operations, potentially leading to system instability or unexpected behavior. Users may experience filesystem unmount failures or system hangs if the issue occurs during critical operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel filesystem issue related to dentry handling during unmount operations. It may indirectly impact compliance if it causes system instability or data corruption during file operations, but no specific compliance impact is documented.

Mitigation Strategies

Apply the kernel patch that flushes the 'deferredclose_wq' before calling 'kill_anon_super'. Update to a kernel version containing the fix. If immediate patching isn't possible, avoid frequent mounting/unmounting of CIFS shares and monitor for the dentry warning in logs.

Hi! I’m here to help you understand CVE-2026-64108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70