CVE-2026-64378

HIGHPre-NVD 7.87.8—
EchelonGraph scoreMEDIUM confidence

Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2026-07-25. a secondary CVSS source baseline 7.8; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, secondary
Trending — 4 sources updated this week
7.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.8Exploit: None knownExposed: 0

A fix is available — apply it.

In the Linux kernel, the following vulnerability has been resolved:

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

When a container exits, the following BUG_ON() is occasionally triggered:

================================================================== VFS: Busy inodes after unmount of sdb (ext4) ------------[ cut here ]------------ kernel BUG at fs/super.c:695! CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1 pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : generic_shutdown_super+0xf0/0x100 lr : generic_shutdown_super+0xf0/0x100 Call trace: generic_shutdown_super+0xf0/0x100 kill_block_super+0x20/0x48 ext4_kill_sb+0x28/0x60 deactivate_locked_super+0x54/0x130 deactivate_super+0x84/0xa0 cleanup_mnt+0xa4/0x140 __cleanup_mnt+0x18/0x28 task_work_run+0x78/0xe0 do_notify_resume+0x204/0x240 ==================================================================

The root cause is a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between inode_prepare_wbs_switch() returning true and the subsequent wb_queue_isw() call. Following is the process that triggers the issue:

CPU A (umount) | CPU B (writeback) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ inode_switch_wbs/cleanup_offline_cgwb atomic_inc(&isw_nr_in_flight) inode_prepare_wbs_switch -> passes SB_ACTIVE check __iget(inode) generic_shutdown_super sb->s_flags &= ~SB_ACTIVE cgroup_writeback_umount(sb) smp_mb() atomic_read(&isw_nr_in_flight) rcu_barrier() -> no pending RCU callbacks flush_workqueue(isw_wq) -> nothing queued, returns evict_inodes(sb) -> Inode skipped as isw still holds a ref. sop->put_super(sb) /* destroys percpu counters */ -> VFS: Busy inodes after unmount! wb_queue_isw() queue_work(isw_wq, ...) /* later in work function */ inode_switch_wbs_work_fn process_inode_switch_wbs iput() -> evict percpu_counter_dec() // UAF!

Fix this by extending the RCU read-side critical section in inode_switch_wbs() and cleanup_offline_cgwb() to cover from inode_prepare_wbs_switch() through wb_queue_isw(). Since there is no sleep in this window, rcu_read_lock() can be used. Then add a synchronize_rcu() in cgroup_writeback_umount() before the existing rcu_barrier(), so that all in-flight switchers that have passed the SB_ACTIVE check have completed queue_work() before flush_workqueue() is called.

The existing rcu_barrier() is intentionally retained so this fix can be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that still queue switches via queue_rcu_work(). It is a no-op on current mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes")) and is removed in a follow-up patch.

CVSS v3
7.8
EG Score
7.8(medium)
EG Risk
40(Track)
EG Risk 40/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity78% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
1%
KEV
Not listed

Published

July 25, 2026

Last Modified

September 8, 2026

Advisory Details (7)

Auto-updated Jul 27, 2026
No patch confirmed yet.
generic

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d
generic

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593
generic

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12
generic

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de
generic

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca
generic

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361
generic

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0

Vendor Advisories for CVE-2026-64378(2)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Patch Availability(5)

Vendor / EcosystemFixed in / PatchReleasedSource
ubuntulinux-virtual-hwe-26.04-edge (7.0.0-31.31) @ resolute2026-09-20ubuntu
ubuntulinux-tools-gcp-edge (7.0.0-1011.11~24.04.1) @ noble2026-09-20ubuntu
ubuntulinux-tools-raspi-realtime-7.0 (7.0.0-1019.19) @ resolute2026-09-20ubuntu
ubuntulinux-tools-oem-7.0 (7.0.0-1013.13) @ resolute2026-09-20ubuntu
ubuntulinux-tools-nvidia-hwe-24.04-edge (7.0.0-1018.18~24.04.1) @ noble2026-09-20ubuntu

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Affected Packages

(6 across 4 ecosystems)
Debian:11(2)
PackageVulnerable rangeFixed inDependents
linux5.10.103-1 ... 5.10.92-2 (55 versions)5.10.262-1—
linux-6.16.1.106-3~deb11u1 ... 6.1.177-1~deb11u1 (22 versions)6.1.180-1~deb11u1—
Debian:12(2)
PackageVulnerable rangeFixed inDependents
linux6.1.106-1 ... 6.1.99-1 (55 versions)6.1.180-1—
linux-6.12—6.12.100-1~deb12u1—
Debian:13(1)
PackageVulnerable rangeFixed inDependents
linux6.12.38-1 ... 6.12.95-1~bpo12+1 (30 versions)6.12.96-1—
Debian:14(1)
PackageVulnerable rangeFixed inDependents
linux6.12.100-1 ... 7.1~rc7-1~exp1 (158 versions)7.1.4-1—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Additional Vendor Advisories

(5)

Vendors that published advisories for this CVE beyond the curated set above. Broader coverage but minimal per-row detail — click through for the original advisory.

Data Freshness Timeline

(refreshed 23× in last 7d / 120× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

Showing the most recent 100 of 259 total refreshes for this CVE.

  1. 2026-09-20 01:25 UTCEG score recompute
  2. 2026-09-20 01:25 UTCVendor advisory
  3. 2026-09-20 01:25 UTCGHSA enrichment
  4. 2026-09-18 19:47 UTCEG score recompute
  5. 2026-09-18 19:47 UTCVendor advisory
  6. 2026-09-18 19:47 UTCGHSA enrichment
  7. 2026-09-18 19:28 UTCEPSS rescore
  8. 2026-09-18 02:47 UTCEG score recompute
  9. 2026-09-18 02:47 UTCVendor advisory
  10. 2026-09-18 02:47 UTCGHSA enrichment
  11. 2026-09-17 01:54 UTCEG score recompute
  12. 2026-09-17 01:54 UTCVendor advisory
  13. 2026-09-17 01:54 UTCGHSA enrichment
  14. 2026-09-16 14:08 UTCEPSS rescore
  15. 2026-09-16 06:30 UTCEG score recompute
  16. 2026-09-16 06:30 UTCVendor advisory
  17. 2026-09-16 06:30 UTCGHSA enrichment
  18. 2026-09-16 05:15 UTCEPSS rescore
  19. 2026-09-15 09:24 UTCEG score recompute
  20. 2026-09-15 09:24 UTCVendor advisory
  21. 2026-09-15 09:24 UTCGHSA enrichment
  22. 2026-09-14 11:48 UTCVendor advisory
  23. 2026-09-14 11:48 UTCGHSA enrichment
  24. 2026-09-14 00:33 UTCEG score recompute
  25. 2026-09-14 00:33 UTCVendor advisory
Show 75 more
  1. 2026-09-14 00:33 UTCGHSA enrichment
  2. 2026-09-13 13:19 UTCVendor advisory
  3. 2026-09-13 13:19 UTCGHSA enrichment
  4. 2026-09-13 02:05 UTCEG score recompute
  5. 2026-09-13 02:05 UTCVendor advisory
  6. 2026-09-13 02:05 UTCGHSA enrichment
  7. 2026-09-12 14:51 UTCVendor advisory
  8. 2026-09-12 14:51 UTCGHSA enrichment
  9. 2026-09-12 03:37 UTCVendor advisory
  10. 2026-09-12 03:37 UTCGHSA enrichment
  11. 2026-09-11 16:23 UTCEG score recompute
  12. 2026-09-11 16:23 UTCVendor advisory
  13. 2026-09-11 16:23 UTCGHSA enrichment
  14. 2026-09-11 14:53 UTCEPSS rescore
  15. 2026-09-11 09:37 UTCEPSS rescore
  16. 2026-09-11 02:16 UTCVendor advisory
  17. 2026-09-11 02:15 UTCGHSA enrichment
  18. 2026-09-10 13:20 UTCEG score recompute
  19. 2026-09-10 13:20 UTCVendor advisory
  20. 2026-09-10 13:19 UTCGHSA enrichment
  21. 2026-09-09 08:36 UTCEG score recompute
  22. 2026-09-09 08:36 UTCVendor advisory
  23. 2026-09-09 08:36 UTCGHSA enrichment
  24. 2026-09-08 22:01 UTCEPSS rescore
  25. 2026-09-08 16:13 UTCVendor advisory
  26. 2026-09-08 16:13 UTCGHSA enrichment
  27. 2026-09-07 21:15 UTCEG score recompute
  28. 2026-09-07 21:15 UTCVendor advisory
  29. 2026-09-07 21:15 UTCGHSA enrichment
  30. 2026-09-07 16:01 UTCEPSS rescore
  31. 2026-09-06 19:13 UTCEG score recompute
  32. 2026-09-06 19:13 UTCVendor advisory
  33. 2026-09-06 19:13 UTCGHSA enrichment
  34. 2026-09-06 13:47 UTCEPSS rescore
  35. 2026-09-06 07:58 UTCGHSA enrichment
  36. 2026-09-05 19:20 UTCEG score recompute
  37. 2026-09-05 19:20 UTCVendor advisory
  38. 2026-09-05 19:20 UTCGHSA enrichment
  39. 2026-09-05 15:31 UTCEPSS rescore
  40. 2026-09-05 06:04 UTCEG score recompute
  41. 2026-09-05 06:04 UTCVendor advisory
  42. 2026-09-05 06:03 UTCGHSA enrichment
  43. 2026-09-04 12:41 UTCEG score recompute
  44. 2026-09-04 12:41 UTCVendor advisory
  45. 2026-09-04 12:41 UTCGHSA enrichment
  46. 2026-09-04 05:07 UTCEPSS rescore
  47. 2026-09-02 14:12 UTCEPSS rescore
  48. 2026-09-01 23:13 UTCEG score recompute
  49. 2026-09-01 23:13 UTCVendor advisory
  50. 2026-09-01 23:13 UTCGHSA enrichment
  51. 2026-09-01 13:54 UTCEPSS rescore
  52. 2026-09-01 04:40 UTCEPSS rescore
  53. 2026-08-30 22:35 UTCEG score recompute
  54. 2026-08-30 22:35 UTCVendor advisory
  55. 2026-08-30 22:35 UTCGHSA enrichment
  56. 2026-08-30 19:17 UTCEPSS rescore
  57. 2026-08-30 11:21 UTCEG score recompute
  58. 2026-08-30 11:21 UTCVendor advisory
  59. 2026-08-30 11:21 UTCGHSA enrichment
  60. 2026-08-30 01:22 UTCEPSS rescore
  61. 2026-08-30 00:08 UTCEG score recompute
  62. 2026-08-30 00:08 UTCVendor advisory
  63. 2026-08-30 00:07 UTCGHSA enrichment
  64. 2026-08-28 21:42 UTCEPSS rescore
  65. 2026-08-27 21:11 UTCEG score recompute
  66. 2026-08-27 21:11 UTCVendor advisory
  67. 2026-08-27 21:11 UTCGHSA enrichment
  68. 2026-08-27 09:57 UTCVendor advisory
  69. 2026-08-27 09:57 UTCGHSA enrichment
  70. 2026-08-26 21:59 UTCVendor advisory
  71. 2026-08-26 21:59 UTCGHSA enrichment
  72. 2026-08-26 10:39 UTCVendor advisory
  73. 2026-08-26 10:39 UTCGHSA enrichment
  74. 2026-08-25 22:40 UTCEG score recompute
  75. 2026-08-25 22:40 UTCVendor advisory

Related CVEs(same vendor + same CWE)

Frequently asked(5)

What is CVE-2026-64378?
CVE-2026-64378 is a high vulnerability published on July 25, 2026. In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount() and inodeswitchwbs() When a container exits, the following BUG_ON() is occasionally triggered: ================================================================== VFS: Busy inodes…
When was CVE-2026-64378 disclosed?
CVE-2026-64378 was first published in the National Vulnerability Database on July 25, 2026, with the most recent update on September 8, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-64378 actively exploited?
CVE-2026-64378 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 99.0% of all scored CVEs.
What is the CVSS score of CVE-2026-64378?
CVE-2026-64378 has a CVSS v3 base score of 7.8 (NVD).
How do I remediate CVE-2026-64378?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-64378, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-64378

Explore →

Is Your Infrastructure Affected by CVE-2026-64378?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs