Look up another CVE · open CVE-2026-64108 in the interactive tracker
CVE-2026-64108
cifs: Fix busy dentry used after unmounting
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64108 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs] The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0 Fix it by flushing 'deferredclose_wq' before calling kill_anon_super. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/client/cifsfs.c
- What this is
- COMMON INTERNET FILE SYSTEM CLIENT (CIFS and SMB3)MAINTAINERS section matched on fs/smb/client/ · linux-cifs@vger.kernel.org · Supported
- Kernel module
- cifs
Check it on the machine
grep -wE 'CONFIG_CIFS|CONFIG_SMBFS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cifsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_CIFS, CONFIG_SMBFS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.1.167 | 6.1.175 | c7364cea5253 |
| 6.6.130 | 6.6.142 | bdc349a87f1f |
| 6.12.78 | 6.12.92 | f2deaa2f409a |
| 6.18.20 | 6.18.34 | 5e7d9d0805e5 |
| 7.0 | 7.0.11 | e1ffa6cf6623 |
| 7.0 | 7.1 | c68337442f03 |
| 6.19.10 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached through local VFS syscalls (open, close, umount) in the CIFS client mount teardown path, not through remote packet handling or in-kernel SMB server code.
- AC:LAttack complexity, low
- An attacker controls both sides of the race by opening/closing files to queue deferred-close work (default 1-second closetimeo) and concurrently triggering umount, and can retry until the window is hit.
- PR:LPrivileges required, low
- Exploitation requires only an unprivileged local user with access to files on an already-mounted CIFS/SMB3 share; mount/umount can be supplied by the attacker in a separate thread if they hold CAP_SYS_ADMIN, or by autofs/system umount on shared enterprise mounts.
- UI:NUser interaction, none
- No victim interaction is required; the attacker drives the open/close/umount syscall sequence directly without relying on another user to open files or click anything.
- S:UScope, unchanged
- Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is not a VM escape, sandbox escape, or cross-security-authority boundary flaw.
- C:HConfidentiality impact, high
- The deferred-close worker performs use-after-free on dentry, inode, and super_block structures after unmount teardown, which can be leveraged for arbitrary kernel memory read per standard UAF guidance.
- I:HIntegrity impact, high
- Post-unmount _cifsFileInfo_put() and cifsFileInfo_put_final() operate on freed kernel objects and can corrupt heap metadata or control flow, enabling arbitrary write or code execution primitives.
- A:HAvailability impact, high
- The race triggers a WARN in generic_shutdown_super during umount and subsequent use-after-free in the deferred-close worker can cause kernel oops, panic, or hang.