CyberSecBulletin
CVE-2026-64378NVD status: Modified

Linux: Concurrent Execution using Shared Resource with Improper Synchronization

Published Updated By the CyberSecBulletin desk

CVE-2026-64378 is a high-severity concurrent execution using shared resource with improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 087d5b8b501c570f84bf655164e6698c3ce146e0, 3c9c9648f77e4d14e50676bc51c2174ba9c8d361, 5c3265f3252b2ee50707adaaa3f9bd0df3df72de as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 087d5b8b501c570f84bf655164e6698c3ce146e0 or 3c9c9648f77e4d14e50676bc51c2174ba9c8d361 or 5c3265f3252b2ee50707adaaa3f9bd0df3df72de or c923cc3cb5cd8945ceaf08252754110643446593, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.5 or 5.10.261 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxa1a0e23e49037c23ea84bc8cc146a03584d13577 up to, but not including, 087d5b8b501c570f84bf655164e6698c3ce146e0; a1a0e23e49037c23ea84bc8cc146a03584d13577 up to, but not including, 3c9c9648f77e4d14e50676bc51c2174ba9c8d361; a1a0e23e49037c23ea84bc8cc146a03584d13577 up to, but not including, 5c3265f3252b2ee50707adaaa3f9bd0df3df72de; a1a0e23e49037c23ea84bc8cc146a03584d13577 up to, but not including, c923cc3cb5cd8945ceaf08252754110643446593; a1a0e23e49037c23ea84bc8cc146a03584d13577 up to, but not including, 685fc15a410885b6d4dee64de0dce721b9428b12; a1a0e23e49037c23ea84bc8cc146a03584d13577 up to, but not including, 53eeaf4d63068dbc7708b0c7adb20151c812feca; a1a0e23e49037c23ea84bc8cc146a03584d13577 up to, but not including, cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d; c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339; and 2 more ranges087d5b8b501c570f84bf655164e6698c3ce146e0, 3c9c9648f77e4d14e50676bc51c2174ba9c8d361, 5c3265f3252b2ee50707adaaa3f9bd0df3df72de, c923cc3cb5cd8945ceaf08252754110643446593, 685fc15a410885b6d4dee64de0dce721b9428b12, 53eeaf4d63068dbc7708b0c7adb20151c812feca
LinuxLinux Kernel4.4.5 up to, but not including, 4.5; 4.5.1 up to, but not including, 5.10.261; 5.11 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.4; 4.54.5, 5.10.261, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a container exits, the following BUG_ON() is occasionally triggered: ================================================================== VFS: Busy inodes after unmount of sdb (ext4) ------------[ cut here ]------------ kernel BUG at fs/super.c:695! CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1 pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : generic_shutdown_super+0xf0/0x100 lr : generic_shutdown_super+0xf0/0x100 Call trace: generic_shutdown_super+0xf0/0x100 kill_block_super+0x20/0x48 ext4_kill_sb+0x28/0x60 deactivate_locked_super+0x54/0x130 deactivate_super+0x84/0xa0 cleanup_mnt+0xa4/0x140 __cleanup_mnt+0x18/0x28 task_work_run+0x78/0xe0 do_notify_resume+0x204/0x240 ================================================================== The root cause is a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between inode_prepare_wbs_switch() returning true and the subsequent wb_queue_isw() call. Following is the process that triggers the issue: CPU A (umount) | CPU B (writeback) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ inode_switch_wbs/cleanup_offline_cgwb atomic_inc(&isw_nr_in_flight) inode_prepare_wbs_switch -> passes SB_ACTIVE check __iget(inode) generic_shutdown_super sb->s_flags &= ~SB_ACTIVE cgroup_writeback_umount(sb) smp_mb() atomic_read(&isw_nr_in_flight) rcu_barrier() -> no pending RCU callbacks flush_workqueue(isw_wq) -> nothing queued, returns evict_inodes(sb) -> Inode skipped as isw still holds a ref. sop->put_super(sb) /* destroys percpu counters */ -> VFS: Busy inodes after unmount! wb_queue_isw() queue_work(isw_wq, ...) /* later in work function */ inode_switch_wbs_work_fn process_inode_switch_wbs iput() -> evict percpu_counter_dec() // UAF! Fix this by extending the RCU read-side critical section in inode_switch_wbs() and cleanup_offline_cgwb() to cover from inode_prepare_wbs_switch() through wb_queue_isw(). Since there is no sleep in this window, rcu_read_lock() can be used. Then add a synchronize_rcu() in cgroup_writeback_umount() before the existing rcu_barrier(), so that all in-flight switchers that have passed the SB_ACTIVE check have completed queue_work() before flush_workqueue() is called. The existing rcu_barrier() is intentionally retained so this fix can be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that still queue switches via queue_rcu_work(). It is a no-op on current mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes")) and is removed in a follow-up patch.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Concurrent Execution using Shared Resource with Improper Synchronization

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How developers prevent this class of flaw

  • In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
  • Use thread-safe capabilities such as the data access abstraction in Spring.
  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

More Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities (CWE-362)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities

Spotted an error? Tell us.