GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64108 (GCVE-0-2026-64108)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
cifs: Fix busy dentry used after unmounting
Summary
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs] The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0 Fix it by flushing 'deferredclose_wq' before calling kill_anon_super. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 708c276f516d27beaded7f372ac8111cee43926c , < c7364cea52531534676b9f7dbc0a477c11f4c050 (git)
Affected: 0629a1a187e424373364d681b42b101894bdb548 , < bdc349a87f1fb02c18c4071858a06542bfea783d (git)
Affected: 0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd , < f2deaa2f409a4598eaa10f2a93a676c0632af248 (git)
Affected: f655467a9973f964b267871e5fef533ad5014494 , < 5e7d9d0805e58fa3760894e73115b7a74024fd07 (git)
Affected: 340cea84f691c5206561bb2e0147158fe02070be , < e1ffa6cf662383f95816eed1b623429d82675e75 (git)
Affected: 340cea84f691c5206561bb2e0147158fe02070be , < c68337442f03953237a94577beb468ab2662a851 (git)
Affected: 30afc6ea72cc6cf7c8d579e79b64232801c38d08 (git)
Affected: 6.1.167 , < 6.1.175 (semver)
Affected: 6.6.130 , < 6.6.142 (semver)
Affected: 6.12.78 , < 6.12.92 (semver)
Affected: 6.18.20 , < 6.18.34 (semver)
Affected: 6.19.10 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c7364cea52531534676b9f7dbc0a477c11f4c050",
              "status": "affected",
              "version": "708c276f516d27beaded7f372ac8111cee43926c",
              "versionType": "git"
            },
            {
              "lessThan": "bdc349a87f1fb02c18c4071858a06542bfea783d",
              "status": "affected",
              "version": "0629a1a187e424373364d681b42b101894bdb548",
              "versionType": "git"
            },
            {
              "lessThan": "f2deaa2f409a4598eaa10f2a93a676c0632af248",
              "status": "affected",
              "version": "0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd",
              "versionType": "git"
            },
            {
              "lessThan": "5e7d9d0805e58fa3760894e73115b7a74024fd07",
              "status": "affected",
              "version": "f655467a9973f964b267871e5fef533ad5014494",
              "versionType": "git"
            },
            {
              "lessThan": "e1ffa6cf662383f95816eed1b623429d82675e75",
              "status": "affected",
              "version": "340cea84f691c5206561bb2e0147158fe02070be",
              "versionType": "git"
            },
            {
              "lessThan": "c68337442f03953237a94577beb468ab2662a851",
              "status": "affected",
              "version": "340cea84f691c5206561bb2e0147158fe02070be",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "30afc6ea72cc6cf7c8d579e79b64232801c38d08",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.175",
              "status": "affected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.142",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.92",
              "status": "affected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.34",
              "status": "affected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1.167",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.12.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.18.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix busy dentry used after unmounting\n\nSince commit 340cea84f691c (\"cifs: open files should not hold ref on\nsuperblock\"), cifs file only holds the dentry ref_cnt, the cifs file\nclose work(cfile-\u003edeferred) could be executed after unmounting, which\nwill trigger a warning in generic_shutdown_super:\n BUG: Dentry 00000000a14a6845{i=c,n=file}  still in use (1) [unmount of\n cifs cifs]\n\nThe detailed processs is:\n   process A           process B           kworker\n fd = open(PATH)\n  vfs_open\n   file-\u003e__f_path = *path // dentry-\u003ed_lockref.count = 1\n   cifs_open\n    cifs_new_fileinfo\n     cfile-\u003edentry = dget(dentry) // dentry-\u003ed_lockref.count = 2\n close(fd)\n  __fput\n  cifs_close\n   queue_delayed_work(deferredclose_wq, cfile-\u003edeferred)\n  dput(dentry) // dentry-\u003ed_lockref.count = 1\n\t\t\t                 smb2_deferred_work_close\n\t\t\t\t\t  _cifsFileInfo_put\n\t\t\t\t\t   list_del(\u0026cifs_file-\u003eflist)\n                    umount\n\t\t     cleanup_mnt\n\t\t      deactivate_super\n\t\t       cifs_kill_sb\n\t\t        cifs_close_all_deferred_files_sb\n\t\t\t cifs_close_all_deferred_files\n\t\t\t  // cannot find cfile, skip _cifsFileInfo_put\n\t\t\tkill_anon_super\n\t\t\t generic_shutdown_super\n\t\t\t  shrink_dcache_for_umount\n\t\t\t   umount_check\n\t\t\t    WARN ! // dentry-\u003ed_lockref.count = 1\n\t\t\t\t\t   cifsFileInfo_put_final\n\t\t\t\t\t    dput(cifs_file-\u003edentry)\n\t\t                            // dentry-\u003ed_lockref.count = 0\n\nFix it by flushing \u0027deferredclose_wq\u0027 before calling kill_anon_super.\n\nFetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local VFS syscalls (open, close, umount) in the CIFS client mount teardown path, not through remote packet handling or in-kernel SMB server code.\nAC:L - An attacker controls both sides of the race by opening/closing files to queue deferred-close work (default 1-second closetimeo) and concurrently triggering umount, and can retry until the window is hit.\nPR:L - Exploitation requires only an unprivileged local user with access to files on an already-mounted CIFS/SMB3 share; mount/umount can be supplied by the attacker in a separate thread if they hold CAP_SYS_ADMIN, or by autofs/system umount on shared enterprise mounts.\nUI:N - No victim interaction is required; the attacker drives the open/close/umount syscall sequence directly without relying on another user to open files or click anything.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is not a VM escape, sandbox escape, or cross-security-authority boundary flaw.\nC:H - The deferred-close worker performs use-after-free on dentry, inode, and super_block structures after unmount teardown, which can be leveraged for arbitrary kernel memory read per standard UAF guidance.\nI:H - Post-unmount _cifsFileInfo_put() and cifsFileInfo_put_final() operate on freed kernel objects and can corrupt heap metadata or control flow, enabling arbitrary write or code execution primitives.\nA:H - The race triggers a WARN in generic_shutdown_super during umount and subsequent use-after-free in the deferred-close worker can cause kernel oops, panic, or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:17.918Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75"
        },
        {
          "url": "https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851"
        }
      ],
      "title": "cifs: Fix busy dentry used after unmounting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64108",
    "datePublished": "2026-07-19T15:40:10.784Z",
    "dateReserved": "2026-07-19T07:54:57.034Z",
    "dateUpdated": "2026-08-05T12:39:17.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64108",
      "date": "2026-09-20",
      "epss": "0.00129",
      "percentile": "0.0294"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cifsfs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c7364cea52531534676b9f7dbc0a477c11f4c050",
                    "status": "affected",
                    "version": "708c276f516d27beaded7f372ac8111cee43926c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bdc349a87f1fb02c18c4071858a06542bfea783d",
                    "status": "affected",
                    "version": "0629a1a187e424373364d681b42b101894bdb548",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f2deaa2f409a4598eaa10f2a93a676c0632af248",
                    "status": "affected",
                    "version": "0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e7d9d0805e58fa3760894e73115b7a74024fd07",
                    "status": "affected",
                    "version": "f655467a9973f964b267871e5fef533ad5014494",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e1ffa6cf662383f95816eed1b623429d82675e75",
                    "status": "affected",
                    "version": "340cea84f691c5206561bb2e0147158fe02070be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c68337442f03953237a94577beb468ab2662a851",
                    "status": "affected",
                    "version": "340cea84f691c5206561bb2e0147158fe02070be",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "30afc6ea72cc6cf7c8d579e79b64232801c38d08",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.175",
                    "status": "affected",
                    "version": "6.1.167",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.142",
                    "status": "affected",
                    "version": "6.6.130",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.92",
                    "status": "affected",
                    "version": "6.12.78",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.34",
                    "status": "affected",
                    "version": "6.18.20",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.20",
                    "status": "affected",
                    "version": "6.19.10",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cifsfs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.142",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CDF8E8A0-BCFF-48A3-99D3-DCB981103267",
                    "versionEndExcluding": "6.1.175",
                    "versionStartIncluding": "6.1.167",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "058207F9-2E6B-49A4-AB8C-A75B7972DA9D",
                    "versionEndExcluding": "6.6.142",
                    "versionStartIncluding": "6.6.130",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "13356F83-00D9-403C-B3A0-65983F234D6F",
                    "versionEndExcluding": "6.12.92",
                    "versionStartIncluding": "6.12.78",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EC619BC6-058F-4EDF-B518-B64F6A5DD2E8",
                    "versionEndExcluding": "6.18.34",
                    "versionStartIncluding": "6.18.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5660E677-FDE2-49F2-9713-4B143B1CEDCC",
                    "versionEndExcluding": "7.0",
                    "versionStartIncluding": "6.19.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3599D100-DF0E-4F7B-90E5-56ECF94051B8",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "7.0.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "EF897730-3F1E-47A2-8B07-22535202C487",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix busy dentry used after unmounting\n\nSince commit 340cea84f691c (\"cifs: open files should not hold ref on\nsuperblock\"), cifs file only holds the dentry ref_cnt, the cifs file\nclose work(cfile-\u003edeferred) could be executed after unmounting, which\nwill trigger a warning in generic_shutdown_super:\n BUG: Dentry 00000000a14a6845{i=c,n=file}  still in use (1) [unmount of\n cifs cifs]\n\nThe detailed processs is:\n   process A           process B           kworker\n fd = open(PATH)\n  vfs_open\n   file-\u003e__f_path = *path // dentry-\u003ed_lockref.count = 1\n   cifs_open\n    cifs_new_fileinfo\n     cfile-\u003edentry = dget(dentry) // dentry-\u003ed_lockref.count = 2\n close(fd)\n  __fput\n  cifs_close\n   queue_delayed_work(deferredclose_wq, cfile-\u003edeferred)\n  dput(dentry) // dentry-\u003ed_lockref.count = 1\n\t\t\t                 smb2_deferred_work_close\n\t\t\t\t\t  _cifsFileInfo_put\n\t\t\t\t\t   list_del(\u0026cifs_file-\u003eflist)\n                    umount\n\t\t     cleanup_mnt\n\t\t      deactivate_super\n\t\t       cifs_kill_sb\n\t\t        cifs_close_all_deferred_files_sb\n\t\t\t cifs_close_all_deferred_files\n\t\t\t  // cannot find cfile, skip _cifsFileInfo_put\n\t\t\tkill_anon_super\n\t\t\t generic_shutdown_super\n\t\t\t  shrink_dcache_for_umount\n\t\t\t   umount_check\n\t\t\t    WARN ! // dentry-\u003ed_lockref.count = 1\n\t\t\t\t\t   cifsFileInfo_put_final\n\t\t\t\t\t    dput(cifs_file-\u003edentry)\n\t\t                            // dentry-\u003ed_lockref.count = 0\n\nFix it by flushing \u0027deferredclose_wq\u0027 before calling kill_anon_super.\n\nFetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548."
          }
        ],
        "id": "CVE-2026-64108",
        "lastModified": "2026-08-12T15:14:14.520",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:52.100",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:07:39+00:00",
      "cve": "CVE-2026-64108",
      "id": "CVE-2026-64108",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cifs: Fix busy dentry used after unmounting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64108.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:09:37Z",
      "cve": "CVE-2026-64108",
      "id": "CVE-2026-64108",
      "initial_release_date": "2026-07-21T12:59:33Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64108",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64108.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.