CVE-2026-64378 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should review and apply the provided patches to prevent potential exploitation.

Why it matters

A race condition vulnerability in the Linux kernel's writeback subsystem can lead to use-after-free and potential privilege escalation. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should review and apply the provided patches to prevent potential exploitation.

• Potential privilege escalation
• Use-after-free vulnerability in the Linux kernel
• Denial of service (DoS) via system crash

Technical summary

The vulnerability is caused by a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). This can lead to a use-after-free vulnerability and potential privilege escalation. The vulnerability is caused by a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). This can lead to a use-after-free vulnerability and potential privilege escalation. Fix this by extending the RCU read-side critical section in inode_switch_wbs() and cleanup_offline_cgwb() to cover from inode_prepare_wbs_switch() through wb_queue_isw().

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). The root cause is a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between inode_prepare_wbs_switch() returning true and the subsequent wb_queue_isw() call. Following is the process that triggers the issue: CPU A (umount) | CPU B (writeback) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ inode_switch_wbs/cleanup_offline_cgwb atomic_inc(&

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.