CVE-2026-43106: cachefiles: fix incorrect dentry refcount in cachefiles_cull()
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix incorrect dentry refcount in cachefilescull()
The patch mentioned below changed cachefilesburyobject() to expect 2 references to the 'rep' dentry. Three of the callers were changed to use startremovingdentry() which takes an extra reference so in those cases the call gets the expected references.
However there is another call to cachefilesburyobject() in cachefilescull() which did not need to be changed to use startremovingdentry() and so was not properly considered. It still passed the dentry with just one reference so the net result is that a reference is lost.
To meet the expectations of cachefilesburyobject(), cachefilescull() must take an extra reference before the call. It will be dropped by cachefilesburyobject().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel cachefiles subsystem (cachefiles_cull/cachefiles_bury_object)to a version that resolves this vulnerability.Patch cachefiles: fix incorrect dentry refcount in cachefiles_cull() - Compensating control
Apply the kernel patch so that cachefiles_bury_object() expects 2 dentry references; ensure the three updated callers use start_removing_dentry() / cachefiles_cull() so the expected extra reference is taken and no dentry refcount is lost during removal.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43106?
CVE-2026-43106 has a medium severity rating due to potential denial of service implications.
How do I fix CVE-2026-43106?
To fix CVE-2026-43106, update your Linux kernel to the latest patched version.
What is the impact of CVE-2026-43106?
The impact of CVE-2026-43106 is primarily related to incorrect dentry reference counting, which may lead to instability.
Which versions of the Linux kernel are affected by CVE-2026-43106?
CVE-2026-43106 affects multiple versions of the Linux kernel prior to the security patch release.
Is CVE-2026-43106 actively being exploited?
As of the latest information, there are no verified active exploits for CVE-2026-43106.