CVE-2026-64378

7.8

Linux · Kernel

A race condition in the Linux kernel writeback mechanism between cgroup_writeback_umount() and inode_switch_wbs() can cause a kernel BUG during container exit.

Executive summary

A race condition vulnerability in the Linux kernel writeback mechanism affects multiple kernel branches, potentially leading to a denial of service and system instability.

Vulnerability

This is a race condition flaw within the kernel writeback and inode switching functions, triggered during container unmount operations by a locally authenticated user.

Business impact

A successful exploit of this vulnerability triggers a kernel panic or BUG condition, resulting in an unexpected system crash and subsequent denial of service for hosted containers and workloads. While the attack vector requires local access and low privileges, the potential for abrupt service disruption poses significant availability risks for multi-tenant environments. The assigned CVSS score of 7.8 reflects the high impact on system availability and integrity despite the restricted local attack surface.

Remediation

Immediate Action: Update the Linux kernel to version 5.10.261, 6.1.178, 6.6.145, 6.12.96, or later depending on the active distribution branch.

Proactive Monitoring: Monitor system logs for unexpected kernel BUG assertions, trace outputs referencing generic_shutdown_super, or container unmount failures.

Compensating Controls: Restrict local shell access and container orchestration privileges to trusted users to mitigate the risk of intentional race condition exploitation.

Exploitation status

Public Exploit Available: No

Analyst recommendation

Administrators managing systems with heavy container workloads should prioritize patching their Linux kernels to the fixed maintenance releases. Applying the kernel update eliminates the race condition window during container termination and ensures overall system stability.

More Linux CVEs

Sources