Executive brief
A vulnerability in the Linux kernel's CIFS (Common Internet File System) client could cause system instability or crashes during the unmounting of network drives. This occurs because the system may attempt to access file information that is still being processed in the background after the drive has been disconnected. While primarily affecting system reliability, it could lead to unexpected behavior in environments relying on network-attached storage.
Technical details
A race condition exists in the Linux kernel CIFS implementation (fs/smb/client/cifsfs.c) due to deferred file closing logic. Since commit 340cea84f691c, open files no longer hold a reference to the superblock, allowing the unmount process to proceed while background worker threads (kworkers) are still executing 'cfile->deferred' close operations. This results in a 'busy dentry' warning in 'generic_shutdown_super' because the dentry reference count remains non-zero during unmount. An attacker with sufficient privileges to mount/unmount CIFS shares could trigger this state. The fix involves flushing the 'deferredclose_wq' workqueue within 'cifs_kill_sb' to ensure all pending file closures complete before the superblock is shut down.
Affected products
- Linux Linux Kernel 340cea84f691c to c7364cea52531534676b9f7dbc0a477c11f4c050
Timeline
- 2026-05-19: other: Initial patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07
- https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d
- https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851
- https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050
- https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75
- https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248