CVE-2026-43106

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix incorrect dentry refcount in cachefiles_cull()

The patch mentioned below changed cachefilesburyobject() to expect 2 references to the 'rep' dentry. Three of the callers were changed to use startremovingdentry() which takes an extra reference so in those cases the call gets the expected references.

However there is another call to cachefilesburyobject() in cachefilescull() which did not need to be changed to use startremoving_dentry() and so was not properly considered. It still passed the dentry with just one reference so the net result is that a reference is lost.

To meet the expectations of cachefilesburyobject(), cachefilescull() must take an extra reference before the call. It will be dropped by cachefilesbury_object().