Executive brief
The Linux kernel's cachefiles module contains a synchronization bug where a directory lock is released twice in an error condition, corrupting the kernel's internal lock state. This can cause the kernel to hang, crash, or become unstable when memory allocation fails during cache directory operations. An attacker with local access could trigger this condition to cause a denial of service.
Technical details
The vulnerability is a double-unlock race condition in the cachefiles_get_directory() function. When start_creating() fails with -ENOMEM, it releases the parent directory inode lock in __start_dirop(). However, the nomem_d_alloc error path unconditionally calls inode_unlock() again on the same lock, corrupting the rwsem (reader-writer semaphore) state. This is a logic error introduced in commit 7ab96df840e60, which replaced manual locking with start_creating() but failed to update the nomem_d_alloc error path (while correctly updating mkdir_error and lookup_error paths). The attack vector requires local access to trigger memory pressure or error conditions during cache directory creation. The fix removes the redundant inode_unlock() call from the nomem_d_alloc path.
Affected products
- Linux Linux kernel 5.0 and later (introduced in commit 7ab96df840e6)
Timeline
- 2026-08-15: disclosed
- 2026-07-01: patched: Patch merged upstream (commit 8c256fba2b46)