CVE-2026-64185: sysfs: don't remove existing directory on update failure

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sysfs: don't remove existing directory on update failure

When sysfs_update_group() is called for a named group and create_files()
fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on
the group directory.  In the update path, kn was obtained via
kernfs_find_and_get() and refers to a directory that already existed
before this call.  Removing it silently destroys a sysfs group that the
caller did not create.

Only remove the directory if we created it ourselves.  On update failure
the directory remains as it is left empty by remove_files() inside
create_files(), but can be repopulated by a retry.

The Linux kernel CVE team has assigned CVE-2026-64185 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 5.10.258 with commit c5e125c828b701afaf7493b42a14aa89362ff36d
	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 5.15.209 with commit ccadd32cc1263802a5969c9efe0e96225450428c
	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.1.175 with commit 14f2c14ae86c4af17a0a9f8ab46dacf2d5fd1d8a
	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.6.142 with commit 31527d80234caf83dc96ad478645e57df9de4472
	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.12.92 with commit 57b285e0368290aa55f79ba11419b96d0ebdb418
	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.18.34 with commit 48fa96538bd2868034d33429e4565fda384d0736
	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 7.0.11 with commit 708f6926f61f71e09b5e9fd668b9882ccd46e69f
	Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 7.1 with commit 237557b8a81ab948e8332f7c0058e758f081c0a3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64185
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/sysfs/group.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c5e125c828b701afaf7493b42a14aa89362ff36d
	https://git.kernel.org/stable/c/ccadd32cc1263802a5969c9efe0e96225450428c
	https://git.kernel.org/stable/c/14f2c14ae86c4af17a0a9f8ab46dacf2d5fd1d8a
	https://git.kernel.org/stable/c/31527d80234caf83dc96ad478645e57df9de4472
	https://git.kernel.org/stable/c/57b285e0368290aa55f79ba11419b96d0ebdb418
	https://git.kernel.org/stable/c/48fa96538bd2868034d33429e4565fda384d0736
	https://git.kernel.org/stable/c/708f6926f61f71e09b5e9fd668b9882ccd46e69f
	https://git.kernel.org/stable/c/237557b8a81ab948e8332f7c0058e758f081c0a3