CVE-2026-43106

cachefiles: fix incorrect dentry refcount in cachefiles_cull()

High · published May 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix incorrect dentry refcount in cachefiles_cull()

The patch mentioned below changed cachefiles_bury_object() to expect 2

references to the 'rep' dentry. Three of the callers were changed to

use start_removing_dentry() which takes an extra reference so in those

cases the call gets the expected references.

However there is another call to cachefiles_bury_object() in

cachefiles_cull() which did not need to be changed to use

start_removing_dentry() and so was not properly considered.

It still passed the dentry with just one reference so the net result is

that a reference is lost.

To meet the expectations of cachefiles_bury_object(), cachefiles_cull()

must take an extra reference before the call. It will be dropped by

cachefiles_bury_object().

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Published
2026-05-06T07:40Z
EPSS history
Timeline
  • 06 MAY 07:40Z
    cachefiles: fix incorrect dentry refcount in cachefiles_cull()
    cvelistv5