CVE-2026-64185 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
sysfs: don't remove existing directory on update failure
When sysfs_update_group() is called for a named group and create_files() fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on the group directory. In the update path, kn was obtained via kernfs_find_and_get() and refers to a directory that already existed before this call. Removing it silently destroys a sysfs group that the caller did not create.
Only remove the directory if we created it ourselves. On update failure the directory remains as it is left empty by remove_files() inside create_files(), but can be repopulated by a retry.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in the linux kernel's sysfs implementation where a critical flaw in the group update mechanism can lead to unintended removal of existing system filesystem directories during update failures. The issue manifests when sysfs_update_group() function processes named groups and encounters failures during the create_files() operation, typically due to memory allocation issues such as -ENOMEM errors. The vulnerability stems from improper directory management logic that causes internal_create_group() to remove kernel filesystem nodes even when those nodes represent pre-existing directories rather than newly created ones. This behavior violates fundamental principles of resource management and system stability by silently destroying legitimate sysfs group structures that were not created by the current operation.
The technical flaw specifically occurs in the update path where kernfs_find_and_get() retrieves existing kernel filesystem nodes that reference directories already present in the system. When create_files() fails, the code incorrectly assumes responsibility for removing these nodes through kernfs_remove(kn) calls. This improper cleanup mechanism creates a scenario where legitimate system directories can be destroyed without proper authorization or awareness from the calling processes. The vulnerability is particularly dangerous because it operates silently, leaving no trace of the directory removal in system logs or error messages, making it extremely difficult to detect and diagnose. According to CWE-276, this represents an improper privilege management issue where the system removes resources it should not have authority to modify, while the ATT&CK framework would classify this as a privilege escalation technique through system resource manipulation.
The operational impact of this vulnerability extends beyond simple directory removal to potentially destabilize system configurations and compromise the integrity of kernel-level filesystem structures. When existing sysfs groups are silently removed during update failures, applications and system processes that depend on these specific group configurations may experience unexpected behavior or complete failure. The vulnerability particularly affects systems that rely heavily on dynamic sysfs group management where updates occur frequently, as the silent removal can lead to cascading failures throughout the kernel subsystems. Recovery from such incidents becomes complex since administrators must manually reconstruct the removed directories and verify that all dependent processes continue to function correctly. The fact that remove_files() inside create_files() leaves directories empty but functional means that retry mechanisms could theoretically restore proper functionality, though this requires careful monitoring and intervention.
The fix for this vulnerability involves implementing proper directory ownership tracking within the sysfs update mechanism to ensure that only directories created by the current operation are removed during failure conditions. This approach aligns with security best practices outlined in the kernel security documentation where resource management must maintain clear boundaries of responsibility and authority. System administrators should implement monitoring solutions to detect unexpected sysfs directory changes and establish automated recovery procedures for critical system groups. The vulnerability demonstrates the importance of maintaining proper resource lifecycle management in kernel code, particularly when dealing with filesystem operations that can affect system stability. Regular security audits of kernel subsystems should include examination of resource cleanup mechanisms to identify similar patterns of improper privilege handling that could lead to system instability or unauthorized modifications.