CVE-2026-64185 Overview
CVE-2026-64185 affects the Linux kernel's sysfs subsystem. The flaw resides in sysfs_update_group() handling of named groups when create_files() fails during an update operation. In this failure path, internal_create_group() invokes kernfs_remove() on the group directory, even though the directory was pre-existing and located via kernfs_find_and_get(). The result is silent destruction of a sysfs group that the caller never created, potentially breaking kernel object interfaces exposed to userspace.
The kernel maintainers resolved the issue by removing the directory only when the current call created it. On update failure, the directory is left in place, empty after remove_files(), and can be repopulated by a retry.
Critical Impact
A failed sysfs group update, such as one triggered by -ENOMEM, can silently remove an existing sysfs directory, disrupting userspace consumers that depend on the affected kernel object interfaces.
Affected Products
- Linux kernel versions containing the vulnerable sysfs_update_group() / internal_create_group() logic
- Distributions shipping upstream stable kernels prior to the fix commits referenced by kernel.org
- Systems where userspace tooling depends on named sysfs groups exposed by kernel subsystems
Discovery Timeline
- 2026-07-19 - CVE-2026-64185 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64185
Vulnerability Analysis
The vulnerability is a logic error in the sysfs group update path. When sysfs_update_group() runs against a named group, internal_create_group() retrieves the existing directory using kernfs_find_and_get(). If the subsequent create_files() call fails, for example due to a memory allocation failure returning -ENOMEM, the error path unconditionally calls kernfs_remove(kn). That removes a directory the update operation did not create, tearing down a live sysfs interface.
The issue is classified as a file system vulnerability affecting kernel object visibility. Userspace daemons, udev rules, and monitoring agents that read attributes from the destroyed group will encounter missing paths until the affected driver or subsystem is unloaded and reloaded.
Root Cause
The root cause is an unqualified cleanup branch that treated the pre-existing named group directory as if the current invocation had allocated it. internal_create_group() did not track whether it created the directory in this call or merely resolved a handle to an existing one, so any allocation or attribute-creation failure during update triggered removal.
Attack Vector
The flaw is reachable through normal kernel paths that call sysfs_update_group() on named groups. Triggering it requires inducing a failure inside create_files(), such as memory pressure that produces -ENOMEM. The EPSS data indicates a very low probability of active exploitation, and no public exploit has been published. The primary impact is unexpected loss of sysfs entries and downstream userspace breakage, not direct code execution.
No verified proof-of-concept code is available. Refer to the upstream commits listed under external references for the exact source-level change: Kernel Git Commit 14f2c14 and Kernel Git Commit 237557b.
Detection Methods for CVE-2026-64185
Indicators of Compromise
- Missing named sysfs group directories under /sys that were previously present for loaded drivers or subsystems
- Kernel log entries showing -ENOMEM or other failures returned from sysfs_update_group() or internal_create_group()
- Userspace tools such as udev, monitoring agents, or hotplug scripts reporting ENOENT on previously valid sysfs paths
Detection Strategies
- Compare running kernel version against the fixed stable releases referenced by the upstream commits to identify unpatched hosts
- Correlate kernel ring buffer messages with sudden disappearance of sysfs attributes to detect the failure condition post facto
- Track memory pressure events on hosts running drivers that call sysfs_update_group() on named groups
Monitoring Recommendations
- Alert on unexpected removal of sysfs directories tied to critical subsystems, including networking, storage, and device management
- Enable persistent kernel log collection and review dmesg for allocation failures in kernfs and sysfs code paths
- Monitor userspace error rates from services that consume sysfs attributes to catch downstream effects of silent removal
How to Mitigate CVE-2026-64185
Immediate Actions Required
- Inventory Linux hosts and identify kernels that predate the upstream fix commits published on kernel.org
- Apply vendor-provided stable kernel updates that incorporate the corrected internal_create_group() behavior
- Reduce sustained memory pressure on production hosts to lower the likelihood of triggering -ENOMEM during sysfs updates
Patch Information
The upstream fix ensures the group directory is removed only when the current call created it. On update failure the directory remains, left empty by remove_files() inside create_files(), and can be repopulated by a retry. Backports are available via the referenced stable commits, including Kernel Git Commit 48fa965, Kernel Git Commit 57b285e, Kernel Git Commit 708f692, Kernel Git Commit c5e125c, and Kernel Git Commit ccadd32.
Workarounds
- No supported source-level workaround exists other than applying the kernel patch
- Reload affected drivers or subsystems to restore missing sysfs groups after a triggered failure
- Where feasible, defer non-critical driver updates that exercise sysfs_update_group() on named groups until patched kernels are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
