HIGH Introduced in 6.1
cachefiles TmpFile DoubleFree
CVE-2026-93810
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput() in error handling in cachefiles_create_tmpfile().
02KernelScan AI Analysis
Risk summary
A local unprivileged user can trigger a double free of a file structure in the cachefiles subsystem when the cache is backed by a filesystem lacking read_iter/write_iter support. The resulting heap corruption could enable privilege escalation or a kernel panic. Products using network filesystems (NFS, CIFS, Ceph) with cachefiles caching enabled are at risk.
Vulnerability analysis
When cachefiles creates a temporary file for network filesystem caching, the error path for an unsupported backing filesystem frees the file object twice. This double free corrupts kernel heap memory and can lead to privilege escalation or a system crash. The fix removes the extra release so the file is freed only once during cleanup. The flaw is reachable when cachefiles is active and a local user accesses files on a cached network filesystem, provided the cache resides on a backing filesystem that lacks standard read and write operations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.1 | 6.1.189 | e582a3e99584 |
| 6.6 | 6.1 | 6.6.158 | 246098a2b8e8 |
| 6.12 | 6.1 | 6.12.111 | e9c2e68c3890 |
| 6.18 | 6.1 | 6.18.53 | 90b306eee037 |
| mainline | 6.1 | 7.2 | af6830cc12df |
| cip/6.12 | 6.1 | 6.12.111-cip32 | e9c2e68c3890 |