CVE-2026-64040 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: Fix error return when vfs_mkdir() fails
When vfs_mkdir() fails, the error code is not extracted from the returned error pointer. This causes mkdir_error to be reached with ret=0, which leads to returning ERR_PTR(0) (NULL) instead of a proper error pointer.
Fix this by extracting the error code from the error pointer when vfs_mkdir() fails.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides in the Linux kernel's cachefiles subsystem where improper error handling during directory creation operations can lead to critical system instability. The flaw occurs when the vfs_mkdir() function encounters a failure condition but fails to properly extract the error code from the returned error pointer structure. This fundamental oversight creates a scenario where the error handling logic incorrectly interprets a failed directory creation attempt as a successful operation, specifically causing the mkdir_error label to be reached with a return value of zero instead of the appropriate negative error code.
The technical implementation flaw stems from the incorrect assumption that when vfs_mkdir() returns an error pointer, the error code can be directly accessed without proper extraction. This violates standard kernel programming practices and creates a path where ERR_PTR(0) is returned instead of a legitimate error pointer representing the actual failure condition. The vulnerability represents a classic case of improper error handling that can lead to cascading failures within the kernel's file system caching mechanisms, potentially allowing malicious actors to exploit the inconsistent error reporting behavior.
The operational impact of this vulnerability extends beyond simple directory creation failures, as it affects the overall reliability and security posture of systems utilizing the Linux kernel's cachefiles functionality. When a directory creation operation fails but returns a success indicator due to the improper error code extraction, downstream components may make incorrect assumptions about system state, potentially leading to data corruption, resource exhaustion, or even privilege escalation opportunities. This issue particularly affects systems where the kernel's file caching subsystem is heavily utilized and where proper error propagation is critical for maintaining system integrity.
Security implications of this vulnerability align with CWE-704 (Incorrect Error Handling) and can be mapped to ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) through potential exploitation of improper error handling that could allow attackers to manipulate system behavior. The fix involves implementing proper error code extraction from the error pointer returned by vfs_mkdir() when failures occur, ensuring that negative error codes are correctly propagated instead of allowing zero values to masquerade as successful operations. This remediation addresses the core issue by enforcing correct error handling patterns and maintaining the integrity of kernel-level error reporting mechanisms.
The vulnerability demonstrates how seemingly minor error handling oversights can have significant security implications within kernel space, particularly when dealing with file system operations that are fundamental to system stability. Proper implementation of error code extraction ensures that all failure conditions are correctly communicated to calling functions, preventing the propagation of invalid state information that could be exploited by malicious actors or cause unpredictable behavior in critical system components. This fix reinforces the importance of rigorous error handling practices in kernel development and aligns with established security frameworks for maintaining robust system integrity.