CVE-2026-64108 - Vulnerability Details

- cifs: Fix busy dentry used after unmounting

Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix busy dentry used after unmounting

Since commit 340cea84f691c ("cifs: open files should not hold ref on
superblock"), cifs file only holds the dentry ref_cnt, the cifs file
close work(cfile->deferred) could be executed after unmounting, which
will trigger a warning in generic_shutdown_super:
BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of
cifs cifs]

The detailed processs is:
process A process B kworker
fd = open(PATH)
vfs_open
file->__f_path = *path // dentry->d_lockref.count = 1
cifs_open
cifs_new_fileinfo
cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2
close(fd)
__fput
cifs_close
queue_delayed_work(deferredclose_wq, cfile->deferred)
dput(dentry) // dentry->d_lockref.count = 1
smb2_deferred_work_close
_cifsFileInfo_put
list_del(&cifs_file->flist)
umount
cleanup_mnt
deactivate_super
cifs_kill_sb
cifs_close_all_deferred_files_sb
cifs_close_all_deferred_files
// cannot find cfile, skip _cifsFileInfo_put
kill_anon_super
generic_shutdown_super
shrink_dcache_for_umount
umount_check
WARN ! // dentry->d_lockref.count = 1
cifsFileInfo_put_final
dput(cifs_file->dentry)
// dentry->d_lockref.count = 0

Fix it by flushing 'deferredclose_wq' before calling kill_anon_super.

Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a reference‑counting flaw in the CIFS file system where a dentry that has been closed can still be referenced by deferred close work after the file system has been unmounted. This can trigger a BUG warning (CWE‑911). The patch fixes the issue by flushing the deferred close work queue before the superblock is shut down.

Affected Systems

The affected product is the Linux kernel; any kernel release that does not yet include the commit that removes the superblock reference during cifs close and adds the flush before unmount is vulnerable. The CVE does not list specific version numbers, so all kernels prior to inclusion of the patch should be considered affected.

Risk and Exploitability

The CVSS score is 7.8, indicating moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of exploitation. The likely attack surface involves interacting with CIFS file handles during an unmount operation, which may require local or elevated privileges; this inference is not directly stated in the input. The effect is a BUG warning in generic_shutdown_super, but no explicit crash or denial of service is documented in the CVE description.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`708c276f516d27beaded7f372ac8111cee43926c`	affected	< c7364cea52531534676b9f7dbc0a477c11f4c050
`0629a1a187e424373364d681b42b101894bdb548`	affected	< bdc349a87f1fb02c18c4071858a06542bfea783d
`0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd`	affected	< f2deaa2f409a4598eaa10f2a93a676c0632af248
`f655467a9973f964b267871e5fef533ad5014494`	affected	< 5e7d9d0805e58fa3760894e73115b7a74024fd07
`340cea84f691c5206561bb2e0147158fe02070be`	affected	< e1ffa6cf662383f95816eed1b623429d82675e75
`340cea84f691c5206561bb2e0147158fe02070be`	affected	< c68337442f03953237a94577beb468ab2662a851
`30afc6ea72cc6cf7c8d579e79b64232801c38d08`	affected	—
`6.1.167`	affected	< 6.1.175
`6.6.130`	affected	< 6.6.142
`6.12.78`	affected	< 6.12.92
`6.18.20`	affected	< 6.18.34
`6.19.10`	affected	< 6.20

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[708c276f516d27beaded7f372ac8111cee43926c,c7364cea52531534676b9f7dbc0a477c11f4c050)`	affected	code_commit	—
`[0629a1a187e424373364d681b42b101894bdb548,bdc349a87f1fb02c18c4071858a06542bfea783d)`	affected	code_commit	—
`[0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd,f2deaa2f409a4598eaa10f2a93a676c0632af248)`	affected	code_commit	—
`[f655467a9973f964b267871e5fef533ad5014494,5e7d9d0805e58fa3760894e73115b7a74024fd07)`	affected	code_commit	—
`[340cea84f691c5206561bb2e0147158fe02070be,e1ffa6cf662383f95816eed1b623429d82675e75)`	affected	code_commit	—
`[340cea84f691c5206561bb2e0147158fe02070be,c68337442f03953237a94577beb468ab2662a851)`	affected	code_commit	—
`30afc6ea72cc6cf7c8d579e79b64232801c38d08`	affected	code_commit	—
`[6.1.167,6.1.175)`	affected	semver	—
`[6.6.130,6.6.142)`	affected	semver	—
`[6.12.78,6.12.92)`	affected	semver	—
`[6.18.20,6.18.34)`	affected	semver	—
`[6.19.10,6.20)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the commit adding a deferred close queue flush before unmounting.
If immediate kernel upgrade is not feasible, manually apply the patch where the deferred close queue is flushed; rebuild and install the updated kernel image.
As a temporary measure, ensure that all CIFS shares are properly unmounted before shutdown or when the system is idle, and monitor system logs for any “Dentry … still in use” warnings, addressing them promptly.

Generated by OpenCVE AI on July 30, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07
https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d
https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851
https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050
https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75
https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248
https://lore.kernel.org/linux-cve-announce/2026071921-CVE-2026-64108-b278@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64108
https://www.cve.org/CVERecord?id=CVE-2026-64108

History

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 20 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026071921-CVE-2026-64108-b278@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64108 https://www.cve.org/CVERecord?id=CVE-2026-64108

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs] The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0 Fix it by flushing 'deferredclose_wq' before calling kill_anon_super. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.
Title		cifs: Fix busy dentry used after unmounting
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07 https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851 https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050 https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75 https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:10.784Z

Updated: 2026-08-05T12:39:17.918Z

Reserved: 2026-07-19T07:54:57.034Z

Link: CVE-2026-64108

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64108 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:45:17Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object