PT-2026-64599 · Linux · Linux
CVE-2026-64378
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
writeback: fix race between cgroup writeback umount() and inode switch wbs()
When a container exits, the following BUG ON() is occasionally triggered:
================================================================== VFS: Busy inodes after unmount of sdb (ext4) ------------[ cut here ]------------ kernel BUG at fs/super.c:695! CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1 pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : generic shutdown super+0xf0/0x100 lr : generic shutdown super+0xf0/0x100 Call trace: generic shutdown super+0xf0/0x100 kill block super+0x20/0x48 ext4 kill sb+0x28/0x60 deactivate locked super+0x54/0x130 deactivate super+0x84/0xa0 cleanup mnt+0xa4/0x140 cleanup mnt+0x18/0x28 task work run+0x78/0xe0 do notify resume+0x204/0x240
The root cause is a race between cgroup writeback umount() and
inode switch wbs()/cleanup offline cgwb(). There is a window between
inode prepare wbs switch() returning true and the subsequent
wb queue isw() call. Following is the process that triggers the issue:
CPU A (umount) | CPU B (writeback)
inode switch wbs/cleanup offline cgwb
atomic inc(&isw nr in flight)
inode prepare wbs switch
-> passes SB ACTIVE check
iget(inode)
generic shutdown super
sb->s flags &= ~SB ACTIVE
cgroup writeback umount(sb)
smp mb()
atomic read(&isw nr in flight)
rcu barrier()
-> no pending RCU callbacks
flush workqueue(isw wq)
-> nothing queued, returns
evict inodes(sb)
-> Inode skipped as isw still holds a ref.
sop->put super(sb)
/* destroys percpu counters */
-> VFS: Busy inodes after unmount!
wb queue isw()
queue work(isw wq, ...)
/* later in work function */
inode switch wbs work fn
process inode switch wbs
iput() -> evict
percpu counter dec() // UAF!
Fix this by extending the RCU read-side critical section in
inode switch wbs() and cleanup offline cgwb() to cover from
inode prepare wbs switch() through wb queue isw(). Since there is
no sleep in this window, rcu read lock() can be used. Then add a
synchronize rcu() in cgroup writeback umount() before the existing
rcu barrier(), so that all in-flight switchers that have passed the
SB ACTIVE check have completed queue work() before flush workqueue()
is called.
The existing rcu barrier() is intentionally retained so this fix can
be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that
still queue switches via queue rcu work(). It is a no-op on current
mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on
wb->list lock when switching inodes")) and is removed in a follow-up
patch. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux