CVE-2026-64108 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix busy dentry used after unmounting
Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of
cifs cifs]
The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0
Fix it by flushing 'deferredclose_wq' before calling kill_anon_super.
Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the linux kernel's cifs filesystem implementation and represents a race condition that can lead to improper resource cleanup during unmount operations. The issue stems from the asynchronous nature of deferred file closing operations that occur after a file descriptor has been closed but before the filesystem is fully unmounted. When a process opens a file on a cifs mount, the kernel establishes references to the dentry structure through multiple pathways including the file's path reference and the cifs file information structure. The problem manifests when the cifs_close function queues a delayed work item for deferred cleanup, but this work executes after the unmount process has already begun, creating a situation where dentry references remain active while the superblock is being torn down.
The technical flaw resides in the improper sequencing of operations during filesystem shutdown. Specifically, the commit referenced in the description changed how cifs files maintain references to superblocks, shifting from holding superblock references to only maintaining dentry references. This change created a window where cfile->deferred work items could execute after unmounting has commenced but before all dentry references have been properly released. The dentry reference counting mechanism tracks these relationships through d_lockref.count values, which increment when references are added and decrement when they're removed. During the normal operation flow, a dentry starts with count 1, increases to 2 when cifs_new_fileinfo creates its own reference, then decreases back to 1 during close processing, but the deferred work can execute after unmounting has started, leaving the dentry in an inconsistent state where it appears to still be in use even though the filesystem is being torn down.
The operational impact of this vulnerability includes kernel warnings and potential system instability during cifs mount operations. The generic_shutdown_super function generates a BUG warning indicating that a dentry is still in use with count 1, which suggests that the dentry reference counting mechanism detected an inconsistency between expected cleanup timing and actual execution. This condition can lead to memory corruption issues, improper resource deallocation, and potentially system crashes when the kernel attempts to clean up filesystem resources while references are still active. The vulnerability specifically affects systems using cifs mounts where files are opened and closed in a manner that triggers the deferred close work queue processing during unmount operations.
The mitigation for this vulnerability involves ensuring proper synchronization of deferred work execution before initiating superblock cleanup operations. The fix implements flushing the 'deferredclose_wq' work queue prior to calling kill_anon_super, which guarantees that all pending deferred close operations complete before the filesystem shutdown process begins. This approach aligns with common best practices for resource management in kernel code where asynchronous operations must be synchronized with cleanup routines to prevent race conditions. The fix directly addresses the timing issue by ensuring that no deferred work items remain queued when superblock destruction begins, thus preventing the dentry reference counting inconsistencies. This solution follows established patterns for managing asynchronous cleanup operations in kernel filesystem implementations and prevents the specific scenario described where cfile->deferred work executes after unmounting has begun but before all references have been properly released.
This vulnerability maps to CWE-367: Time-of-Check to Time-of-Use (TOCTOU) and CWE-829: Inclusion of Functionality from Untrusted Control Sphere, as it represents a race condition where the state of filesystem resources changes between when they are checked for cleanup and when actual cleanup occurs. From an ATT&CK perspective, this vulnerability could be leveraged in privilege escalation scenarios or system stability compromise during filesystem management operations, particularly affecting network filesystem access patterns where multiple processes interact with shared cifs mounts. The fix demonstrates proper kernel resource management practices by ensuring that asynchronous cleanup work is completed before proceeding with destructive operations like mount removal, which aligns with the principle of maintaining consistent state throughout system operations and preventing race conditions in kernel subsystems.