{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-72315", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-72315" ], "published": "2026-08-15T06:04:33Z", "summary": "smb: client: fix busy dentry warning on unmount after DIO", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix busy dentry warning on unmount after DIO\n\nCommit c68337442f03 (\"cifs: Fix busy dentry used after unmounting\") fixed\nthe issue in cifs where deferred close of a file led to a dentry reference\ncount not being released in umount, by flushing deferredclose_wq in\ncifs_kill_sb() to solve it.\n\nHowever, the cifs DIO path suffers from the same busy-dentry problem caused\nby a delayed dentry reference-count release:\n\n\t[dio]\t\t\t[cifsd]\t\t\t[close + umount]\nnetfs_unbuffered_write_iter_locked\n...\n\t\t\t\tcifs_demultiplex_thread\n netfs_unbuffered_write\n cifs_issue_write\n netfs_wait_for_in_progress_stream [1]\n\t\t\t\t...\n\t\t\t\t netfs_write_subrequest_terminated\n\t\t\t\t netfs_subreq_clear_in_progress\n\t\t\t\t netfs_wake_collector // wake [1]\n\t\t\t\t netfs_put_subrequest\n netfs_put_request\n queue_work(system_dfl_wq, xxx) [2]\n // dio write return\t\t\t\t\tcifs_close\n\t\t\t\t\t\t\t _cifsFileInfo_put\n\t\t\t\t\t\t\t // cfile->count 2->1\n\t\t\t\t\t\t\t --cfile->count [3]\n\n\t\t\t\t\t\t\t// umount\n\t\t\t\t\t\t\tcifs_kill_sb\n\t\t\t\t\t\t\t kill_anon_super\n\t\t\t\t\t\t\t // warning triggered!\n\t\t\t\t\t\t\t shrink_dcache_for_umount [4]\n[system_dfl_wq] [5]\nnetfs_free_request\n ...\n _cifsFileInfo_put\n // cfile->count 1->0\n --cfile->count\n queue_work(fileinfo_put_wq, xxx)\n\n[fileinfo_put_wq] [6]\ncifsFileInfo_put_work\n cifsFileInfo_put_final\n dput\n\nIf the umount path is triggered before [5], it results warning:\nBUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test} still in use (1)\n[unmount of cifs cifs]\n\nThe existing per-inode ictx->io_count wait in cifs_evict_inode() does not\nhelp: it lives in the inode eviction path, which runs after\nshrink_dcache_for_umount() has already warned about the busy dentries.\n\nFix it by adding a per-superblock outstanding-rreq counter that is\nincremented in cifs_init_request() and decremented in cifs_free_request().\nIn cifs_kill_sb(), before kill_anon_super(), wait for this counter to reach\n0 - which guarantees that all cleanup_work for this sb have run and thus\nall relevant cfile puts are queued on fileinfo_put_wq or serverclose_wq.\nThen drain the workqueue so the dentry refs are dropped.\n\nThis is a targeted wait, not a flush of the system-wide system_dfl_wq.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.87-1+rpt1~bookworm", "1:6.12.93-1+rpt1", "1:6.12.96-1+rpt1", "1:6.12.109-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.87+rpt-rpi-2712", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v6", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7l", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-2712", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v6", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v7", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v7l", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8-rt", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-2712", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v6", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v7", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v7l", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8-rt", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-2712", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v6", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v7", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v7l", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v8", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v8-rt", "binary_version": "1:6.12.109-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.87-1+rpt1~bookworm": { "linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0", "upstream_version": "6.12.87", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.112" }, "1:6.12.93-1+rpt1": { "linux_commit": "d8ab4e908235da7727f22dd36ad5af224671677d", "upstream_version": "6.12.93", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.112" }, "1:6.12.96-1+rpt1": { "linux_commit": "ae161617d7a4552fa91d03626b8d9f3696d17481", "upstream_version": "6.12.96", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.112" }, "1:6.12.109-1+rpt1": { "linux_commit": "7d1826930811232688a50c99c540fbb137aed081", "upstream_version": "6.12.109", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.112" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.54" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.54" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.54" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.54" }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.54" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72315" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f7748b551010c021d92f0125e37f32ac0c376d8a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9fc87899276af941ecf3045798887db7deb85605" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f0eac9c3c3711f24efc2aaf12b8ec3e54a38c214" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-10-03T11:04:09Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The flaw is reached through local VFS syscalls (open with O_DIRECT, pwrite, close, umount) on the in-kernel CIFS/SMB3 client mount teardown path, not via remote SMB packet handling or ksmbd server code.\nAC:L - The attacker controls both sides of the race by issuing concurrent O_DIRECT writes and close/umount from separate threads, can flood system_dfl_wq to widen the cleanup delay window, and can retry until the post-pwrite/pre-cleanup_work window is hit.\nPR:L - Exploitation requires only a local user with write access to files on an already-mounted CIFS/SMB3 share; mount/umount can be performed by the same attacker with namespace capabilities or triggered by autofs lazy-unmount on shared enterprise home-directory mounts.\nUI:N - No victim interaction is required; the attacker directly drives the open/pwrite/close/umount syscall sequence in a tight loop without relying on another user to open files or perform any action.\nS:U - Impact is confined to kernel heap corruption and privilege escalation within the same host; this is not a VM escape, sandbox escape, or cross-security-authority boundary flaw.\nC:H - Delayed netfs cleanup causes cifsFileInfo_put_final() to dereference dentry, inode, and cifsInodeInfo structures after superblock teardown has begun, constituting a use-after-free that can be leveraged for arbitrary kernel memory read.\nI:H - Post-unmount cifsFileInfo_put_final() performs lock operations and list manipulation on freed kernel objects via fileinfo_put_wq, enabling heap metadata corruption and control-flow hijacking for arbitrary write or code execution.\nA:H - The race triggers WARN in shrink_dcache_for_umount during umount, and subsequent use-after-free in the deferred dentry put worker can cause kernel oops, panic, or hang." } } }