CVE-2026-64040 Overview
CVE-2026-64040 is a Linux kernel vulnerability in the cachefiles subsystem. The flaw stems from improper error handling when vfs_mkdir() fails during cache directory creation. The kernel fails to extract the error code from the returned error pointer, causing the mkdir_error path to execute with ret=0. This results in ERR_PTR(0) (NULL) being returned instead of a valid error pointer, which callers may dereference or misinterpret as success.
Critical Impact
The bug can trigger NULL pointer dereferences in callers that expect a valid error pointer, leading to kernel instability or denial of service in systems using the cachefiles caching backend for network filesystems.
Affected Products
- Linux kernel — cachefiles subsystem
- Distributions shipping affected stable kernel branches prior to the fix commits
- Systems using FS-Cache with cachefiles backend (commonly NFS, AFS, Ceph, 9P)
Discovery Timeline
- 2026-07-19 - CVE-2026-64040 published to the National Vulnerability Database (NVD)
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64040
Vulnerability Analysis
The vulnerability resides in the Linux kernel cachefiles module, which provides a local filesystem-backed cache for network filesystems via the FS-Cache facility. During cache directory creation, the code calls vfs_mkdir() to instantiate a new directory entry. When vfs_mkdir() fails, it returns an ERR_PTR-encoded error value rather than propagating the error into the local ret variable.
The faulty code path jumps to mkdir_error while ret remains zero. The error handler then constructs and returns ERR_PTR(0), which evaluates to NULL. Callers testing the return value with IS_ERR() receive false, treating the NULL pointer as a valid dentry. Subsequent dereferences produce a kernel oops.
The upstream fix extracts the error code from the returned pointer using PTR_ERR() before branching to the cleanup path. This ensures a genuine negative error value propagates to callers. Fix commits are tracked as 0940108d27c6 and 8a220d1c312c in the mainline and stable trees.
Root Cause
The root cause is missing error-code extraction after a failed vfs_mkdir() call. The affected code checks for failure but neglects to assign PTR_ERR(subdir) to ret before jumping to the error label, producing a NULL pointer dereference downstream [CWE-476].
Attack Vector
Triggering the flaw requires operations that cause vfs_mkdir() to fail during cachefiles directory creation, such as quota exhaustion, permission errors, or filesystem corruption on the cache backing store. A local user with the ability to influence cache directory operations can induce the fault path. The vulnerability is a reliability and denial-of-service issue rather than a direct code execution primitive.
No public proof-of-concept exploit is available. See the Linux Kernel Commit 0940108d and Linux Kernel Commit 8a220d1c for the patch details.
Detection Methods for CVE-2026-64040
Indicators of Compromise
- Kernel oops or panic messages referencing cachefiles_ symbols and NULL pointer dereferences in dmesg or /var/log/kern.log.
- Unexpected termination of cachefilesd or FS-Cache-backed mounts (NFS, Ceph, AFS) accompanied by stack traces implicating cachefiles_get_directory or cachefiles_lookup_object.
- Repeated cache directory creation failures logged prior to a crash.
Detection Strategies
- Query installed kernel package versions across the fleet and compare against distribution advisories that reference the fix commits 0940108d27c6 and 8a220d1c312c.
- Ingest kernel ring buffer events into a centralized logging pipeline and alert on BUG:, NULL pointer dereference, and cachefiles co-occurrences.
- Monitor host reboot patterns on systems using FS-Cache to catch intermittent crashes tied to cache directory operations.
Monitoring Recommendations
- Enable persistent kernel crash dumping with kdump on hosts running cachefiles to capture actionable stack traces.
- Track cachefilesd service health and restart counts through your host telemetry platform.
- Baseline the rate of vfs_mkdir failures on cache backing filesystems and alert on statistically significant deviations.
How to Mitigate CVE-2026-64040
Immediate Actions Required
- Inventory Linux hosts using FS-Cache with the cachefiles backend, typically identifiable by the presence of cachefilesd and mounts using the fsc option.
- Apply vendor kernel updates that include commits 0940108d27c6995e02819ff832be11892f0b208b and 8a220d1c312c66194f4a33dd52d1fba42bc2b341.
- Schedule reboots after kernel package installation to activate the patched image.
Patch Information
The fix is available in the mainline Linux kernel and backported stable branches. Reference the upstream commits 0940108d27c6 and 8a220d1c312c. Consult your distribution's security tracker for the exact package version containing the backport.
Workarounds
- Disable the cachefiles backend by stopping and masking the cachefilesd service where local caching is not required.
- Remount FS-Cache-backed filesystems without the fsc option to bypass the vulnerable code path until patching completes.
- Ensure the cache backing filesystem has sufficient free space, inodes, and correct permissions to reduce the likelihood of triggering vfs_mkdir() failures.
# Verify running kernel and cachefiles usage
uname -r
systemctl status cachefilesd
# Temporarily disable the cachefiles backend
sudo systemctl stop cachefilesd
sudo systemctl mask cachefilesd
# Remount NFS shares without FS-Cache (adjust mount point)
sudo mount -o remount,nofsc /mnt/nfs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
