Executive brief
A vulnerability was identified in the Linux kernel's cachefiles system, which manages local caching for network filesystems. An error in how the system tracks internal file references could lead to system instability or a crash. This could potentially be exploited by a local user to disrupt operations or gain unauthorized access to system resources.
Technical details
A reference count leak exists in the cachefiles_cull() function within the Linux kernel. The function cachefiles_bury_object() was updated to expect two references to the 'rep' dentry, but the caller in cachefiles_cull() was not updated to provide the additional reference. This results in an incorrect decrement of the dentry reference count, leading to a lost reference and potential use-after-free scenarios. An attacker with local access could exploit this flaw to cause a denial of service (system crash) or potentially escalate privileges. The issue has been resolved by ensuring cachefiles_cull() takes an extra reference via dget() before calling cachefiles_bury_object().
Affected products
- Linux Linux Kernel 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-27: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-06: advisory