CVE-2026-64108: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64108 Overview

CVE-2026-64108 is a use-after-free vulnerability in the Linux kernel's CIFS (Common Internet File System) client. The flaw stems from a race between the deferred file close work queue and filesystem unmount operations. A CIFS file's deferred close work (cfile->deferred) can execute after unmounting completes, leaving a busy dentry that triggers a warning in generic_shutdown_super and corrupts kernel memory state.

The issue was introduced by commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), which changed CIFS files to hold only a dentry reference count instead of a superblock reference. Local attackers with the ability to mount and access CIFS shares can trigger the condition.

Critical Impact
Local attackers can trigger a use-after-free condition in the Linux kernel's CIFS subsystem, potentially leading to kernel memory corruption, denial of service, or privilege escalation on systems that mount CIFS/SMB shares.

Affected Products

Linux kernel versions containing commit 340cea84f691c in the CIFS client
Systems mounting remote SMB/CIFS shares using the in-kernel CIFS module
Stable kernel branches receiving backports of the referenced CIFS commits

Discovery Timeline

2026-07-19 - CVE-2026-64108 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64108

Vulnerability Analysis

The vulnerability is a use-after-free race condition [CWE-416] in the Linux CIFS client's deferred close mechanism. When a process opens a file on a CIFS mount, the kernel increments the dentry d_lockref.count. On close, the CIFS layer queues a delayed workqueue item (deferredclose_wq) to defer the actual close operation.

If an unmount operation runs concurrently, cifs_close_all_deferred_files_sb may execute before the deferred work fires. The unmount path fails to locate the pending cfile structure and skips releasing it. Subsequently, kill_anon_super calls generic_shutdown_super, which invokes shrink_dcache_for_umount and triggers a warning because the dentry reference count is still nonzero.

The deferred work then finally runs cifsFileInfo_put_final and calls dput on an already-destroyed superblock context, producing memory corruption in kernel space.

Root Cause

The root cause is missing synchronization between the CIFS deferredclose_wq workqueue and the filesystem teardown path. Because CIFS files no longer hold a reference on the superblock, nothing prevents the superblock from being torn down while deferred close work items remain pending. The fix flushes deferredclose_wq before calling kill_anon_super to guarantee that all deferred close operations complete before the superblock is destroyed.

Attack Vector

Exploitation requires local access with permission to mount or interact with CIFS shares. An attacker races open/close operations on a CIFS-mounted file against a concurrent umount. The kernel maintainers reference a working reproducer available in the upstream kernel bug tracker at Linux kernel bugzilla entry 221548.

The vulnerability manifests without any exploit code required beyond the reproducer sequence. See the upstream commits for technical details on the race window and the specific ordering that triggers the WARN in umount_check.

Detection Methods for CVE-2026-64108

Indicators of Compromise

Kernel log messages containing BUG: Dentry ... still in use ... [unmount of cifs cifs]
Warnings originating from generic_shutdown_super or shrink_dcache_for_umount on hosts using CIFS mounts
Unexpected kernel oops or panic traces referencing cifsFileInfo_put_final, smb2_deferred_work_close, or deferredclose_wq
Repeated mount/unmount activity against CIFS shares from non-administrative user contexts

Detection Strategies

Monitor dmesg and /var/log/kern.log for the specific dentry-in-use warning signature associated with CIFS unmount
Correlate CIFS mount/unmount syscall telemetry with file open/close activity on the same superblock
Track kernel version and applied stable patch levels against the six referenced fix commits

Monitoring Recommendations

Forward kernel log warnings and oops messages to a centralized logging pipeline for retention and alerting
Alert on any process making rapid mount/umount calls for cifs filesystems, especially from unprivileged users
Baseline expected CIFS mount lifecycle behavior and flag deviations that could indicate race exploitation attempts

How to Mitigate CVE-2026-64108

Immediate Actions Required

Apply the upstream Linux kernel stable patches referenced in the CVE advisory as soon as vendor-signed builds are available
Inventory hosts using the in-kernel cifs module and prioritize patching for systems where local users can mount or access SMB shares
Restrict CIFS mount privileges to trusted users via mount capability controls and fstab policies

Patch Information

The fix flushes the deferredclose_wq workqueue before kill_anon_super is invoked, ensuring all deferred CIFS close operations complete prior to superblock teardown. Patches are available in the following upstream commits:

Workarounds

Where patching is not immediately possible, unload the cifs kernel module on systems that do not require SMB client functionality using modprobe -r cifs
Prevent unprivileged users from mounting CIFS filesystems by removing user or users options from /etc/fstab entries and enforcing CAP_SYS_ADMIN for mount operations
Avoid concurrent open/close and unmount activity against CIFS shares in production workflows until patches are applied