CVE-2026-64378
- Source
- https://cve.org/CVERecord?id=CVE-2026-64378
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64378.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64378
- Downstream
- Published
- 2026-07-25T08:50:29.006Z
- Modified
- 2026-07-27T04:03:19.819837355Z
- Summary
- writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
writeback: fix race between cgroupwritebackumount() and inodeswitchwbs()
When a container exits, the following BUG_ON() is occasionally triggered:
================================================================== VFS: Busy inodes after unmount of sdb (ext4) ------------[ cut here ]------------ kernel BUG at fs/super.c:695! CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1 pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : genericshutdownsuper+0xf0/0x100 lr : genericshutdownsuper+0xf0/0x100 Call trace: genericshutdownsuper+0xf0/0x100 killblocksuper+0x20/0x48 ext4killsb+0x28/0x60 deactivatelockedsuper+0x54/0x130 deactivatesuper+0x84/0xa0 cleanupmnt+0xa4/0x140 _cleanupmnt+0x18/0x28 taskworkrun+0x78/0xe0
donotifyresume+0x204/0x240
The root cause is a race between cgroupwritebackumount() and inodeswitchwbs()/cleanupofflinecgwb(). There is a window between inodepreparewbsswitch() returning true and the subsequent wbqueue_isw() call. Following is the process that triggers the issue:
CPU A (umount) | CPU B (writeback)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ inodeswitchwbs/cleanupofflinecgwb atomicinc(&iswnrinflight) inodepreparewbsswitch -> passes SBACTIVE check _iget(inode) genericshutdownsuper sb->sflags &= ~SBACTIVE cgroupwritebackumount(sb) smpmb() atomicread(&iswnrinflight) rcubarrier() -> no pending RCU callbacks flushworkqueue(iswwq) -> nothing queued, returns evictinodes(sb) -> Inode skipped as isw still holds a ref. sop->putsuper(sb) /* destroys percpu counters */ -> VFS: Busy inodes after unmount! wbqueueisw() queuework(iswwq, ...) /* later in work function */ inodeswitchwbsworkfn processinodeswitchwbs iput() -> evict percpucounterdec() // UAF!
Fix this by extending the RCU read-side critical section in inodeswitchwbs() and cleanupofflinecgwb() to cover from inodepreparewbsswitch() through wbqueueisw(). Since there is no sleep in this window, rcureadlock() can be used. Then add a synchronizercu() in cgroupwritebackumount() before the existing rcubarrier(), so that all in-flight switchers that have passed the SBACTIVE check have completed queuework() before flushworkqueue() is called.
The existing rcubarrier() is intentionally retained so this fix can be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that still queue switches via queuercuwork(). It is a no-op on current mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on wb->listlock when switching inodes")) and is removed in a follow-up patch.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64378.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0
- https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361
- https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca
- https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de
- https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12
- https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593
- https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64378.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64378
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda1a0e23e49037c23ea84bc8cc146a03584d13577Fixed087d5b8b501c570f84bf655164e6698c3ce146e0Fixed3c9c9648f77e4d14e50676bc51c2174ba9c8d361Fixed5c3265f3252b2ee50707adaaa3f9bd0df3df72deFixedc923cc3cb5cd8945ceaf08252754110643446593Fixed685fc15a410885b6d4dee64de0dce721b9428b12Fixed53eeaf4d63068dbc7708b0c7adb20151c812fecaFixedcba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedc5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4.4.5Fixed4.5
Affected versions
v2.*
v3.*
v4.*
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced4.5.0Fixed5.10.261
- Type
- ECOSYSTEM
- Events
-
Introduced5.11.0Fixed6.1.178
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.6.145
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.12.96
- Type
- ECOSYSTEM
- Events
-
Introduced6.13.0Fixed6.18.39
- Type
- ECOSYSTEM
- Events
-
Introduced6.19.0Fixed7.1.4