CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
Greg Kroah-Hartman <[email protected]> Sat, 25 Jul 2026 10:49:55 +0200
| Newsgroups | org.kernel.vger.linux-cve-announce |
|---|---|
| Message-ID | <2026072524-CVE-2026-64378-78c8@gregkh> |
From: Greg Kroah-Hartman <[email protected]> Description =========== In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a container exits, the following BUG_ON() is occasionally triggered: ================================================================== VFS: Busy inodes after unmount of sdb (ext4) ------------[ cut here ]------------ kernel BUG at fs/super.c:695! CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1 pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : generic_shutdown_super+0xf0/0x100 lr : generic_shutdown_super+0xf0/0x100 Call trace: generic_shutdown_super+0xf0/0x100 kill_block_super+0x20/0x48 ext4_kill_sb+0x28/0x60 deactivate_locked_super+0x54/0x130 deactivate_super+0x84/0xa0 cleanup_mnt+0xa4/0x140 __cleanup_mnt+0x18/0x28 task_work_run+0x78/0xe0 do_notify_resume+0x204/0x240 ================================================================== The root cause is a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between inode_prepare_wbs_switch() returning true and the subsequent wb_queue_isw() call. Following is the process that triggers the issue: CPU A (umount) | CPU B (writeback) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ inode_switch_wbs/cleanup_offline_cgwb atomic_inc(&isw_nr_in_flight) inode_prepare_wbs_switch -> passes SB_ACTIVE check __iget(inode) generic_shutdown_super sb->s_flags &= ~SB_ACTIVE cgroup_writeback_umount(sb) smp_mb() atomic_read(&isw_nr_in_flight) rcu_barrier() -> no pending RCU callbacks flush_workqueue(isw_wq) -> nothing queued, returns evict_inodes(sb) -> Inode skipped as isw still holds a ref. sop->put_super(sb) /* destroys percpu counters */ -> VFS: Busy inodes after unmount! wb_queue_isw() queue_work(isw_wq, ...) /* later in work function */ inode_switch_wbs_work_fn process_inode_switch_wbs iput() -> evict percpu_counter_dec() // UAF! Fix this by extending the RCU read-side critical section in inode_switch_wbs() and cleanup_offline_cgwb() to cover from inode_prepare_wbs_switch() through wb_queue_isw(). Since there is no sleep in this window, rcu_read_lock() can be used. Then add a synchronize_rcu() in cgroup_writeback_umount() before the existing rcu_barrier(), so that all in-flight switchers that have passed the SB_ACTIVE check have completed queue_work() before flush_workqueue() is called. The existing rcu_barrier() is intentionally retained so this fix can be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that still queue switches via queue_rcu_work(). It is a no-op on current mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes")) and is removed in a follow-up patch. The Linux kernel CVE team has assigned CVE-2026-64378 to this issue. Affected and fixed versions =========================== Issue introduced in 4.5 with commit a1a0e23e49037c23ea84bc8cc146a03584d13577 and fixed in 5.10.261 with commit 087d5b8b501c570f84bf655164e6698c3ce146e0 Issue introduced in 4.5 with commit a1a0e23e49037c23ea84bc8cc146a03584d13577 and fixed in 6.1.178 with commit 3c9c9648f77e4d14e50676bc51c2174ba9c8d361 Issue introduced in 4.5 with commit a1a0e23e49037c23ea84bc8cc146a03584d13577 and fixed in 6.6.145 with commit 5c3265f3252b2ee50707adaaa3f9bd0df3df72de Issue introduced in 4.5 with commit a1a0e23e49037c23ea84bc8cc146a03584d13577 and fixed in 6.12.96 with commit c923cc3cb5cd8945ceaf08252754110643446593 Issue introduced in 4.5 with commit a1a0e23e49037c23ea84bc8cc146a03584d13577 and fixed in 6.18.39 with commit 685fc15a410885b6d4dee64de0dce721b9428b12 Issue introduced in 4.5 with commit a1a0e23e49037c23ea84bc8cc146a03584d13577 and fixed in 7.1.4 with commit 53eeaf4d63068dbc7708b0c7adb20151c812feca Issue introduced in 4.5 with commit a1a0e23e49037c23ea84bc8cc146a03584d13577 and fixed in 7.2-rc1 with commit cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d Issue introduced in 4.4.5 with commit c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64378 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/fs-writeback.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0 https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361 https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593 https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12 https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d