PT-2026-61425 · Linux · Linux
CVE-2026-64108
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix busy dentry used after unmounting
Since commit 340cea84f691c ("cifs: open files should not hold ref on
superblock"), cifs file only holds the dentry ref cnt, the cifs file
close work(cfile->deferred) could be executed after unmounting, which
will trigger a warning in generic shutdown super:
BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of
cifs cifs]
The detailed processs is:
process A process B kworker
fd = open(PATH)
vfs open
file-> f path = *path // dentry->d lockref.count = 1
cifs open
cifs new fileinfo
cfile->dentry = dget(dentry) // dentry->d lockref.count = 2
close(fd)
fput
cifs close
queue delayed work(deferredclose wq, cfile->deferred)
dput(dentry) // dentry->d lockref.count = 1
smb2 deferred work close
cifsFileInfo put
list del(&cifs file->flist)
umount
cleanup mnt
deactivate super
cifs kill sb
cifs close all deferred files sb
cifs close all deferred files
// cannot find cfile, skip cifsFileInfo put
kill anon super
generic shutdown super
shrink dcache for umount
umount check
WARN ! // dentry->d lockref.count = 1
cifsFileInfo put final
dput(cifs file->dentry)
// dentry->d lockref.count = 0
Fix it by flushing 'deferredclose wq' before calling kill anon super.
Fetch a reproducer in https://bugzilla.kernel.org/show bug.cgi?id=221548.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux