CVE-2026-43106: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43106 Overview

CVE-2026-43106 is a Linux kernel vulnerability in the cachefiles subsystem. The flaw involves an incorrect dentry reference count in the cachefiles_cull() function. A prior patch modified cachefiles_bury_object() to expect two references to the rep dentry. While three callers were updated to use start_removing_dentry(), which acquires the additional reference, the call site in cachefiles_cull() was overlooked. The omission causes a reference count imbalance, dropping a reference that should remain held. This kernel-level bug affects file system caching reliability and stability.

Critical Impact
The reference counting imbalance in cachefiles_cull() can lead to dentry use-after-free conditions or kernel memory corruption when the cache cull path executes.

Affected Products

Linux kernel versions containing the prior cachefiles_bury_object() reference count change
Distributions shipping the affected upstream cachefiles subsystem
Systems using FS-Cache with the cachefiles backend

Discovery Timeline

2026-05-06 - CVE CVE-2026-43106 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43106

Vulnerability Analysis

The vulnerability resides in the Linux kernel cachefiles subsystem, which provides on-disk caching for network file systems via FS-Cache. The function cachefiles_bury_object() is responsible for removing cached objects from the backing file system. A previous refactor changed this function to require the caller to hold two references on the target dentry. The function consumes both references during cleanup.

Three of the four callers were migrated to start_removing_dentry(), which performs the extra dget() to satisfy the new contract. The fourth caller, cachefiles_cull(), was not updated. It continues to invoke cachefiles_bury_object() while holding only a single reference. The shortfall produces a net loss of one reference on the dentry once cachefiles_bury_object() returns.

Root Cause

The root cause is an incomplete API contract migration. When cachefiles_bury_object() was modified to consume two dentry references, the audit of callers missed cachefiles_cull(). The function performs object eviction during cache size enforcement and must hand off a properly referenced dentry. Passing a dentry with insufficient references leads to premature deallocation by the dentry cache. This category of bug is a reference count miscount [CWE-911 / CWE-672 class] in kernel code.

Attack Vector

Exploitation requires triggering the cache cull path, which the kernel invokes when the cachefiles backing store reaches its configured culling thresholds. A local user with the ability to populate or interact with FS-Cache backed mounts can drive the cull path. The resulting reference imbalance can corrupt dentry state, destabilize the VFS layer, or create a window for use-after-free conditions on the freed dentry. The fix restores the contract by adding an explicit dget() in cachefiles_cull() before the call to cachefiles_bury_object(), which then drops it during cleanup.

No public proof-of-concept is available. See the kernel commit fixing the issue and the related review commit for technical details.

Detection Methods for CVE-2026-43106

Indicators of Compromise

Kernel oops or panic messages referencing cachefiles_cull, cachefiles_bury_object, or dentry put paths in dmesg
Unexpected file system instability or stale dentry warnings on hosts using FS-Cache with the cachefiles backend
KASAN reports flagging use-after-free in dentry structures during cache culling activity

Detection Strategies

Audit running kernel versions across the fleet and compare against the upstream stable trees that include the fix commit 6577df7dc7a7
Enable CONFIG_DEBUG_KMEMLEAK or KASAN on test systems to surface dentry reference count anomalies during cache cull workloads
Monitor systemd journal and kernel ring buffer for repeated faults originating in fs/cachefiles/namei.c

Monitoring Recommendations

Collect kernel crash dumps and dmesg output centrally for hosts using cachefilesd
Track FS-Cache metrics under /proc/fs/fscache/stats for abnormal eviction or error counters
Alert on kernel panics correlated with cachefiles cull operations on cache-heavy workloads such as NFS or AFS clients

How to Mitigate CVE-2026-43106

Immediate Actions Required

Apply the upstream stable kernel update that includes commit 6577df7dc7a7de128442b6192c7a32195c923480 from the appropriate Linux stable tree
Inventory hosts running cachefilesd and prioritize patching those with active FS-Cache deployments
Reboot affected systems after kernel package upgrades to load the fixed kernel image

Patch Information

The fix adds an explicit dget() in cachefiles_cull() so that two references are held when calling cachefiles_bury_object(), matching the function's expected contract. Apply vendor-supplied kernel updates from your distribution that incorporate this commit. Reference the upstream fix commit for the exact change.

Workarounds

Stop and disable the cachefilesd service on systems where FS-Cache disk caching is not required
Unmount FS-Cache backed file systems with the fsc mount option until a patched kernel is deployed
Reduce the likelihood of triggering the cull path by provisioning sufficient cache storage to keep usage below the brun/bcull thresholds in cachefilesd.conf

bash

# Disable cachefilesd until kernel is patched
sudo systemctl stop cachefilesd
sudo systemctl disable cachefilesd

# Verify no FS-Cache-backed mounts remain
mount | grep -E 'fsc|fscache'

# Confirm patched kernel is running after upgrade and reboot
uname -r