CVE-2026-64378: Linux Kernel Race Condition Vulnerability

CVE-2026-64378 Overview

CVE-2026-64378 is a race condition in the Linux kernel writeback subsystem. The flaw exists between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() code paths. When a container exits, the race can trigger a BUG_ON() at fs/super.c:695 with the message VFS: Busy inodes after unmount. This leads to a use-after-free (UAF) on percpu counters when the writeback work function later calls iput() and percpu_counter_dec() on a superblock whose structures have already been destroyed.

Critical Impact
A local unprivileged user running container workloads can trigger a kernel BUG and use-after-free on filesystem structures, resulting in denial of service and potential memory corruption.

Affected Products

Linux kernel (mainline, prior to the fix)
Stable branches including 5.10.y and 6.6.y that queue switches via queue_rcu_work()
Container runtimes and distributions shipping affected kernels (e.g., environments running containerd-shim workloads)

Discovery Timeline

2026-07-25 - CVE-2026-64378 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64378

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the cgroup writeback code. When a container exits and its filesystem is unmounted, cgroup_writeback_umount() on CPU A runs concurrently with inode_switch_wbs() or cleanup_offline_cgwb() on CPU B. CPU B increments isw_nr_in_flight and passes the SB_ACTIVE check inside inode_prepare_wbs_switch(), taking an inode reference via __iget(). Before CPU B calls wb_queue_isw() to queue the work, CPU A clears SB_ACTIVE, observes zero pending RCU callbacks, and finds an empty isw_wq workqueue. CPU A then proceeds to evict_inodes(), which skips the pinned inode, and calls put_super(), destroying the percpu counters.

Root Cause

The root cause is an insufficient synchronization window between inode_prepare_wbs_switch() returning true and the subsequent wb_queue_isw() call. The smp_mb() and rcu_barrier() in cgroup_writeback_umount() do not cover the interval where an inflight switcher has passed the SB_ACTIVE check but has not yet queued the work item. When the delayed inode_switch_wbs_work_fn finally executes, it invokes iput() and percpu_counter_dec() against freed superblock state.

Attack Vector

Exploitation requires local access with the ability to create and tear down containers or mount namespaces. An attacker running workloads that repeatedly trigger inode writeback cgroup switching while unmounting the underlying filesystem can hit the race window. The primary observable outcome is a kernel BUG and system crash. The trailing use-after-free on percpu counters raises the possibility of memory corruption under specific timing conditions.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream commit messages linked in the references section.

Detection Methods for CVE-2026-64378

Indicators of Compromise

Kernel log entries containing VFS: Busy inodes after unmount followed by a kernel BUG at fs/super.c panic trace.
Call traces referencing generic_shutdown_super, kill_block_super, ext4_kill_sb, and cleanup_mnt on container exit.
Unexpected container runtime process crashes (for example, containerd-shim) coinciding with filesystem unmount events.

Detection Strategies

Monitor dmesg and /var/log/kern.log for the specific BUG signature at fs/super.c:695 and correlate with container lifecycle events.
Compare running kernel versions against the fixed commits listed in the kernel.org references to identify unpatched hosts.
Track host uptime regressions and unexpected reboots on nodes running container workloads with per-container storage.

Monitoring Recommendations

Ingest kernel ring buffer logs into a centralized log platform and alert on BUG: and VFS: Busy inodes strings.
Instrument container orchestration telemetry to flag repeated shim exits or node NotReady transitions during pod teardown.
Enable kernel crash dump collection (kdump) on production container hosts to capture forensic state for post-crash analysis.

How to Mitigate CVE-2026-64378

Immediate Actions Required

Inventory kernel versions across container hosts and identify systems running vulnerable 5.10.y, 6.6.y, or earlier mainline builds.
Apply the upstream stable kernel updates that include the fix and reboot affected nodes.
Restrict the ability of untrusted users to create mount namespaces or unprivileged containers where feasible.

Patch Information

The fix extends the RCU read-side critical section in inode_switch_wbs() and cleanup_offline_cgwb() to cover from inode_prepare_wbs_switch() through wb_queue_isw(). It also adds a synchronize_rcu() in cgroup_writeback_umount() before the existing rcu_barrier(), ensuring all in-flight switchers that passed the SB_ACTIVE check have completed queue_work() before flush_workqueue() runs. The patch is available across multiple stable branches. See Kernel Commit 087d5b8b501c, Kernel Commit 3c9c9648f77e, Kernel Commit 53eeaf4d6306, Kernel Commit 5c3265f3252b, Kernel Commit 685fc15a4108, Kernel Commit c923cc3cb5cd, and Kernel Commit cba38ec4cbd3.

Workarounds

No configuration-based workaround fully eliminates the race; upgrading the kernel is the only complete remediation.
Reduce container churn on affected hosts to lower the probability of hitting the race window until patches are applied.
Limit CAP_SYS_ADMIN and unprivileged user namespace access to reduce local attack surface.

bash

# Verify running kernel version and reboot into patched kernel
uname -r

# Debian/Ubuntu: apply pending kernel updates
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic
sudo reboot

# RHEL/CentOS/Rocky: apply kernel updates
sudo dnf update kernel
sudo reboot

# Restrict unprivileged user namespace creation (Debian/Ubuntu example)
sudo sysctl -w kernel.unprivileged_userns_clone=0