In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix busy dentry used after unmounting

Since commit 340cea84f691c ("cifs: open files should not hold ref on
superblock"), cifs file only holds the dentry ref_cnt, the cifs file
close work(cfile->deferred) could be executed after unmounting, which
will trigger a warning in generic_shutdown_super:
BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of
cifs cifs]

The detailed processs is:
process A process B kworker
fd = open(PATH)
vfs_open
file->__f_path = *path // dentry->d_lockref.count = 1
cifs_open
cifs_new_fileinfo
cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2
close(fd)
__fput
cifs_close
queue_delayed_work(deferredclose_wq, cfile->deferred)
dput(dentry) // dentry->d_lockref.count = 1
smb2_deferred_work_close
_cifsFileInfo_put
list_del(&cifs_file->flist)
umount
cleanup_mnt
deactivate_super
cifs_kill_sb
cifs_close_all_deferred_files_sb
cifs_close_all_deferred_files
// cannot find cfile, skip _cifsFileInfo_put
kill_anon_super
generic_shutdown_super
shrink_dcache_for_umount
umount_check
WARN ! // dentry->d_lockref.count = 1
cifsFileInfo_put_final
dput(cifs_file->dentry)
// dentry->d_lockref.count = 0

Fix it by flushing 'deferredclose_wq' before calling kill_anon_super.

Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
708c276f516d27beaded7f372ac8111cee43926c affected < c7364cea52531534676b9f7dbc0a477c11f4c050
0629a1a187e424373364d681b42b101894bdb548 affected < bdc349a87f1fb02c18c4071858a06542bfea783d
0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd affected < f2deaa2f409a4598eaa10f2a93a676c0632af248
f655467a9973f964b267871e5fef533ad5014494 affected < 5e7d9d0805e58fa3760894e73115b7a74024fd07
340cea84f691c5206561bb2e0147158fe02070be affected < e1ffa6cf662383f95816eed1b623429d82675e75
340cea84f691c5206561bb2e0147158fe02070be affected < c68337442f03953237a94577beb468ab2662a851
30afc6ea72cc6cf7c8d579e79b64232801c38d08 affected —
6.1.167 affected < 6.1.175
6.6.130 affected < 6.6.142
6.12.78 affected < 6.12.92
6.18.20 affected < 6.18.34
6.19.10 affected < 6.20
Linux Linux affected
Version Status Constraints
7.0 affected —
0 unaffected < 7.0
6.1.175 unaffected ≤ 6.1.*
6.6.142 unaffected ≤ 6.6.*
6.12.92 unaffected ≤ 6.12.*
6.18.34 unaffected ≤ 6.18.*
7.0.11 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07 cve-icon
https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d cve-icon
https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851 cve-icon
https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050 cve-icon
https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75 cve-icon
https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248 cve-icon
History

Sun, 19 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs] The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0 Fix it by flushing 'deferredclose_wq' before calling kill_anon_super. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.
Title cifs: Fix busy dentry used after unmounting
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T15:40:10.784Z

Reserved: 2026-07-19T07:54:57.034Z

Link: CVE-2026-64108

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.