CVE-2026-64108: cifs: Fix busy dentry used after unmounting
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix busy dentry used after unmounting
Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry refcnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in genericshutdownsuper: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs]
The detailed processs is: process A process B kworker fd = open(PATH) vfsopen file->fpath = path // dentry->dlockref.count = 1 cifsopen cifsnewfileinfo cfile->dentry = dget(dentry) // dentry->dlockref.count = 2 close(fd) fput cifsclose queuedelayedwork(deferredclosewq, cfile->deferred) dput(dentry) // dentry->dlockref.count = 1 smb2deferredworkclose cifsFileInfoput listdel(&cifsfile->flist) umount cleanupmnt deactivatesuper cifskillsb cifsclosealldeferredfilessb cifsclosealldeferredfiles // cannot find cfile, skip cifsFileInfoput killanonsuper genericshutdownsuper shrinkdcacheforumount umountcheck WARN ! // dentry->dlockref.count = 1 cifsFileInfoputfinal dput(cifsfile->dentry) // dentry->dlockref.count = 0
Fix it by flushing 'deferredclosewq' before calling killanonsuper.
Fetch a reproducer in https://bugzilla.kernel.org/showbug.cgi?id=221548.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64108?
CVE-2026-64108 has a high severity score of 7.8 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-64108?
To fix CVE-2026-64108, you should update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2026-64108?
CVE-2026-64108 affects Linux kernel versions that implement the CIFS file system.
What type of vulnerability is CVE-2026-64108?
CVE-2026-64108 is a memory safety vulnerability involving a busy dentry being used after unmounting.
What impact could CVE-2026-64108 have on my system?
Exploitation of CVE-2026-64108 could potentially lead to information disclosure, system crashes, or arbitrary code execution.