CVE-2026-64378

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.10.y through 6.6.y

Description A race condition exists between the cgroup writeback umount() and inode switch wbs()/cleanup offline cgwb() functions. This occurs when a container exits, creating a window between the time inode prepare wbs switch() returns true and the subsequent wb queue isw() call. This race can lead to a Use-After-Free (UAF) scenario where percpu counter dec() is called after percpu counters have been destroyed during the unmount process, potentially triggering a kernel BUG ON() and resulting in the error VFS: Busy inodes after unmount.

Recommendations For Linux kernel versions 5.10.y through 6.6.y, apply the update that extends the RCU read-side critical section in inode switch wbs() and cleanup offline cgwb() to cover the range from inode prepare wbs switch() through wb queue isw(), and adds synchronize rcu() in cgroup writeback umount() before the rcu barrier().