CVE-2026-64164: Linux Kernel Race Condition Vulnerability

CVE-2026-64164 Overview

CVE-2026-64164 is a Linux kernel vulnerability in the btrfs filesystem tracepoint subsystem. The flaw resides in the btrfs_sync_file() trace event, which executes in an atomic context. The tracepoint calls dget_parent() followed by dput(), and dput() can sleep. This triggers a kernel splat with the message BUG: sleeping function called from invalid context at fs/dcache.c:970 when the trace event is enabled during file synchronization operations.

The issue is reproducible by enabling the trace event and running the btrfs/056 test from fstests. The fix replaces dget_parent()/dput() with direct access to the parent dentry via dentry->d_parent, aligning btrfs behavior with the equivalent ext4 ext4_sync_file_enter() tracepoint.

Critical Impact
Enabling the btrfs btrfs_sync_file tracepoint on affected kernels causes kernel warnings and potential instability during file sync operations, degrading reliability on systems using btrfs with tracing enabled.

Affected Products

Linux kernel builds containing the btrfs_sync_file tracepoint prior to the referenced stable commits
Systems using btrfs as a filesystem with kernel tracing infrastructure enabled
Distributions shipping affected upstream and stable kernel branches

Discovery Timeline

2026-07-19 - CVE-2026-64164 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64164

Vulnerability Analysis

The defect is a kernel-level [Kernel Vulnerability] rooted in improper handling of atomic execution context inside a tracepoint. Linux tracepoints run with preemption disabled, meaning any function invoked from within a tracepoint handler must not sleep. The btrfs_sync_file trace event violates this contract by calling dget_parent() to obtain a reference to the parent dentry, then releasing it via dput(). The dput() path can reach dput.part.0 and call into code that may block, producing the __might_resched warning shown in the reported dmesg splat.

The call chain observed during reproduction runs from __x64_sys_pwrite64 through vfs_write, btrfs_do_write_iter, and btrfs_sync_file, into trace_event_raw_event_btrfs_sync_file, which invokes dput.part.0. At that point the scheduler detects preempt_count: 2 and emits the warning.

Root Cause

The root cause is misuse of the dentry reference API inside an atomic tracepoint handler. Taking and dropping a dentry reference is unnecessary here because the parent dentry is already reachable through dentry->d_parent while the tracepoint is active. The reference counting adds no correctness benefit while introducing a sleepable path into a non-sleepable context.

Attack Vector

The vulnerability is not a remote exploitation primitive. It manifests as a reliability and denial-of-service class defect triggered by legitimate workloads when the specific tracepoint is enabled by a privileged administrator. Any user-space process performing fsync-style operations on a btrfs filesystem can generate the kernel splat while the tracepoint is active.

The vulnerability manifests in the trace_event_raw_event_btrfs_sync_file handler. See the upstream commits referenced below for the technical fix, which replaces dget_parent()/dput() with direct parent access.

Detection Methods for CVE-2026-64164

Indicators of Compromise

Kernel log entries containing BUG: sleeping function called from invalid context at fs/dcache.c correlated with btrfs activity
__might_resched warnings referencing trace_event_raw_event_btrfs_sync_file in stack traces
Repeated kernel warnings on hosts where the btrfs sync_file tracepoint has been enabled via tracefs

Detection Strategies

Monitor dmesg and /var/log/kern.log for the specific splat signature tied to btrfs_sync_file and dput.part.0
Audit systems for enabled tracepoints under /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable
Correlate kernel warnings with running kernel version to identify hosts still on unpatched builds referenced in the upstream commits

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on sleeping function called from invalid context patterns
Track kernel version inventory across the fleet to identify hosts missing the stable backports
Include btrfs-heavy workloads such as build servers and container hosts in reliability monitoring dashboards

How to Mitigate CVE-2026-64164

Immediate Actions Required

Update to a Linux kernel build that includes one of the referenced stable commits fixing the btrfs_sync_file tracepoint
Disable the btrfs_sync_file tracepoint on unpatched systems if it is not required for active debugging
Restrict access to tracefs and debugfs to privileged administrators only

Patch Information

The fix is committed to the upstream Linux kernel and backported across stable branches. Refer to the following kernel commits: Kernel Git Commit 0a96d9a, Kernel Git Commit 12a0487, Kernel Git Commit 26b2290, Kernel Git Commit 4361954, Kernel Git Commit 6279992, Kernel Git Commit c32a7e0, Kernel Git Commit c73370c, and Kernel Git Commit d78b0a8. Apply distribution updates that incorporate these commits.

Workarounds

Keep the btrfs_sync_file tracepoint disabled on production systems until the kernel patch is applied
Limit filesystem tracing to short-duration diagnostic sessions supervised by administrators
Consider ext4 or an already-patched kernel for hosts that require continuous filesystem tracing

bash

# Verify the btrfs_sync_file tracepoint is disabled
cat /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable

# Disable the tracepoint if currently enabled
echo 0 | sudo tee /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable

# Confirm kernel version and applied patch level
uname -r