CVE-2026-64108: cifs: Fix busy dentry used after unmounting

Greg Kroah-Hartman <[email protected]>
Newsgroups org.kernel.vger.linux-cve-announce
Message-ID <2026071921-CVE-2026-64108-b278@gregkh>
From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix busy dentry used after unmounting

Since commit 340cea84f691c ("cifs: open files should not hold ref on
superblock"), cifs file only holds the dentry ref_cnt, the cifs file
close work(cfile->deferred) could be executed after unmounting, which
will trigger a warning in generic_shutdown_super:
 BUG: Dentry 00000000a14a6845{i=c,n=file}  still in use (1) [unmount of
 cifs cifs]

The detailed processs is:
   process A           process B           kworker
 fd = open(PATH)
  vfs_open
   file->__f_path = *path // dentry->d_lockref.count = 1
   cifs_open
    cifs_new_fileinfo
     cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2
 close(fd)
  __fput
  cifs_close
   queue_delayed_work(deferredclose_wq, cfile->deferred)
  dput(dentry) // dentry->d_lockref.count = 1
			                 smb2_deferred_work_close
					  _cifsFileInfo_put
					   list_del(&cifs_file->flist)
                    umount
		     cleanup_mnt
		      deactivate_super
		       cifs_kill_sb
		        cifs_close_all_deferred_files_sb
			 cifs_close_all_deferred_files
			  // cannot find cfile, skip _cifsFileInfo_put
			kill_anon_super
			 generic_shutdown_super
			  shrink_dcache_for_umount
			   umount_check
			    WARN ! // dentry->d_lockref.count = 1
					   cifsFileInfo_put_final
					    dput(cifs_file->dentry)
		                            // dentry->d_lockref.count = 0

Fix it by flushing 'deferredclose_wq' before calling kill_anon_super.

Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.

The Linux kernel CVE team has assigned CVE-2026-64108 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1.167 with commit 708c276f516d27beaded7f372ac8111cee43926c and fixed in 6.1.175 with commit c7364cea52531534676b9f7dbc0a477c11f4c050
	Issue introduced in 6.6.130 with commit 0629a1a187e424373364d681b42b101894bdb548 and fixed in 6.6.142 with commit bdc349a87f1fb02c18c4071858a06542bfea783d
	Issue introduced in 6.12.78 with commit 0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd and fixed in 6.12.92 with commit f2deaa2f409a4598eaa10f2a93a676c0632af248
	Issue introduced in 6.18.20 with commit f655467a9973f964b267871e5fef533ad5014494 and fixed in 6.18.34 with commit 5e7d9d0805e58fa3760894e73115b7a74024fd07
	Issue introduced in 7.0 with commit 340cea84f691c5206561bb2e0147158fe02070be and fixed in 7.0.11 with commit e1ffa6cf662383f95816eed1b623429d82675e75
	Issue introduced in 7.0 with commit 340cea84f691c5206561bb2e0147158fe02070be and fixed in 7.1 with commit c68337442f03953237a94577beb468ab2662a851
	Issue introduced in 6.19.10 with commit 30afc6ea72cc6cf7c8d579e79b64232801c38d08

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64108
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/cifsfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050
	https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d
	https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248
	https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07
	https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75
	https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.