CVE-2026-64378

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()<br /> <br /> When a container exits, the following BUG_ON() is occasionally triggered:<br /> <br /> ==================================================================<br /> VFS: Busy inodes after unmount of sdb (ext4)<br /> ------------[ cut here ]------------<br /> kernel BUG at fs/super.c:695!<br /> CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1<br /> pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)<br /> pc : generic_shutdown_super+0xf0/0x100<br /> lr : generic_shutdown_super+0xf0/0x100<br /> Call trace:<br /> generic_shutdown_super+0xf0/0x100<br /> kill_block_super+0x20/0x48<br /> ext4_kill_sb+0x28/0x60<br /> deactivate_locked_super+0x54/0x130<br /> deactivate_super+0x84/0xa0<br /> cleanup_mnt+0xa4/0x140<br /> __cleanup_mnt+0x18/0x28<br /> task_work_run+0x78/0xe0<br /> do_notify_resume+0x204/0x240<br /> ==================================================================<br /> <br /> The root cause is a race between cgroup_writeback_umount() and<br /> inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between<br /> inode_prepare_wbs_switch() returning true and the subsequent<br /> wb_queue_isw() call. Following is the process that triggers the issue:<br /> <br /> CPU A (umount) | CPU B (writeback)<br /> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /> inode_switch_wbs/cleanup_offline_cgwb<br /> atomic_inc(&amp;isw_nr_in_flight)<br /> inode_prepare_wbs_switch<br /> -&gt; passes SB_ACTIVE check<br /> __iget(inode)<br /> generic_shutdown_super<br /> sb-&gt;s_flags &amp;= ~SB_ACTIVE<br /> cgroup_writeback_umount(sb)<br /> smp_mb()<br /> atomic_read(&amp;isw_nr_in_flight)<br /> rcu_barrier()<br /> -&gt; no pending RCU callbacks<br /> flush_workqueue(isw_wq)<br /> -&gt; nothing queued, returns<br /> evict_inodes(sb)<br /> -&gt; Inode skipped as isw still holds a ref.<br /> sop-&gt;put_super(sb)<br /> /* destroys percpu counters */<br /> -&gt; VFS: Busy inodes after unmount!<br /> wb_queue_isw()<br /> queue_work(isw_wq, ...)<br /> /* later in work function */<br /> inode_switch_wbs_work_fn<br /> process_inode_switch_wbs<br /> iput() -&gt; evict<br /> percpu_counter_dec() // UAF!<br /> <br /> Fix this by extending the RCU read-side critical section in<br /> inode_switch_wbs() and cleanup_offline_cgwb() to cover from<br /> inode_prepare_wbs_switch() through wb_queue_isw(). Since there is<br /> no sleep in this window, rcu_read_lock() can be used. Then add a<br /> synchronize_rcu() in cgroup_writeback_umount() before the existing<br /> rcu_barrier(), so that all in-flight switchers that have passed the<br /> SB_ACTIVE check have completed queue_work() before flush_workqueue()<br /> is called.<br /> <br /> The existing rcu_barrier() is intentionally retained so this fix can<br /> be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that<br /> still queue switches via queue_rcu_work(). It is a no-op on current<br /> mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on<br /> wb-&gt;list_lock when switching inodes")) and is removed in a follow-up<br /> patch.