From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-64185: sysfs: don't remove existing directory on update failure
Date: Sun, 19 Jul 2026 17:40:47 +0200 [thread overview]
Message-ID: <2026071939-CVE-2026-64185-8b0d@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
sysfs: don't remove existing directory on update failure
When sysfs_update_group() is called for a named group and create_files()
fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on
the group directory. In the update path, kn was obtained via
kernfs_find_and_get() and refers to a directory that already existed
before this call. Removing it silently destroys a sysfs group that the
caller did not create.
Only remove the directory if we created it ourselves. On update failure
the directory remains as it is left empty by remove_files() inside
create_files(), but can be repopulated by a retry.
The Linux kernel CVE team has assigned CVE-2026-64185 to this issue.
Affected and fixed versions
===========================
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 5.10.258 with commit c5e125c828b701afaf7493b42a14aa89362ff36d
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 5.15.209 with commit ccadd32cc1263802a5969c9efe0e96225450428c
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.1.175 with commit 14f2c14ae86c4af17a0a9f8ab46dacf2d5fd1d8a
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.6.142 with commit 31527d80234caf83dc96ad478645e57df9de4472
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.12.92 with commit 57b285e0368290aa55f79ba11419b96d0ebdb418
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 6.18.34 with commit 48fa96538bd2868034d33429e4565fda384d0736
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 7.0.11 with commit 708f6926f61f71e09b5e9fd668b9882ccd46e69f
Issue introduced in 4.19 with commit c855cf2759d27142f771173d9fd8e7fdf9cf5138 and fixed in 7.1 with commit 237557b8a81ab948e8332f7c0058e758f081c0a3
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-64185
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
fs/sysfs/group.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/c5e125c828b701afaf7493b42a14aa89362ff36d
https://git.kernel.org/stable/c/ccadd32cc1263802a5969c9efe0e96225450428c
https://git.kernel.org/stable/c/14f2c14ae86c4af17a0a9f8ab46dacf2d5fd1d8a
https://git.kernel.org/stable/c/31527d80234caf83dc96ad478645e57df9de4472
https://git.kernel.org/stable/c/57b285e0368290aa55f79ba11419b96d0ebdb418
https://git.kernel.org/stable/c/48fa96538bd2868034d33429e4565fda384d0736
https://git.kernel.org/stable/c/708f6926f61f71e09b5e9fd668b9882ccd46e69f
https://git.kernel.org/stable/c/237557b8a81ab948e8332f7c0058e758f081c0a3
reply other threads:[~2026-07-19 15:47 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026071939-CVE-2026-64185-8b0d@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox