Junglewise Threat Intelligence

CVE-2026-64378: Linux Kernel race condition in cgroup writeback unmount

CVE-2026-64378 · Severity: info · CVSS 5.5 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition was identified in the Linux kernel's writeback mechanism, which manages how data is saved from memory to disk. When a container or process exits and unmounts a filesystem, a timing error can cause the system to crash or experience a 'use-after-free' error where the system tries to access memory that has already been cleared. This primarily impacts system stability and availability, potentially leading to a kernel crash (BUG_ON) during routine container operations.

Technical details

A race condition exists between cgroup_writeback_umount() and inode_switch_wbs() / cleanup_offline_cgwb(). The vulnerability occurs because a window exists between inode_prepare_wbs_switch() passing the SB_ACTIVE check and the subsequent wb_queue_isw() call. During this window, an unmount operation (generic_shutdown_super) can clear the SB_ACTIVE flag and proceed to destroy per-CPU counters while a writeback switcher still holds a reference to an inode. This results in a 'Busy inodes after unmount' BUG_ON() or a use-after-free when the switcher later attempts to decrement the destroyed counters. The fix involves extending RCU read-side critical sections and adding synchronize_rcu() to ensure all in-flight switchers complete before the unmount process drains the workqueues.

Affected products

  • Linux Linux kernel 5.10.y, 6.6.y, and others prior to the fix

Timeline

  • 2026-07-16: patched: Initial patch authored
  • 2026-07-24: patched: Patch committed to stable tree
  • 2026-07-25: disclosed: CVE published

References

Related threats