Description

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput() in error handling in cachefiles_create_tmpfile().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-24T17:17:14.433Z",
  "pubdate": "2026-09-24T17:17:14.433Z",
  "executiveSummary": "This vulnerability involves a double fput() operation within the Linux kernel's cachefiles component, specifically identified in the cachefiles_create_tmpfile() function.\nA double fput() signifies a reference counting error where a file structure's reference count is decremented multiple times for a single acquisition. This typically leads to a use-after-free or a kernel panic due to an inconsistent reference count state.\nThe vulnerability resides in the error handling path of the tmpfile creation process. If an error condition is encountered, the kernel erroneously releases the file reference twice, which can compromise kernel stability and integrity.\nThe impact of this flaw is significant, potentially leading to denial-of-service (kernel crash) or, theoretically, memory corruption vulnerabilities that could be leveraged for local privilege escalation.\nThe affected system is the Linux kernel's cachefiles filesystem caching backend. Exploitation requires an attacker to trigger the specific error handling path in cachefiles_create_tmpfile(), necessitating local access or specific filesystem operations that induce an error during temporary file instantiation.\nRisk implications include potential system instability and the possibility of arbitrary code execution if the resulting use-after-free can be weaponized against kernel objects.",
  "technicalDetails": "The vulnerability is located in the Linux kernel filesystem caching layer, specifically within the cachefiles_create_tmpfile() function. The root cause is a logic error during the error handling sequence where the reference count for a file structure is prematurely or redundantly decremented.\nIn the Linux kernel, fput() is used to release a reference to a file object. Each file object tracks its references via a counter; if the counter reaches zero, the object is deallocated. A double fput() error occurs when the code invokes fput() on a file pointer that has already had its reference count reconciled, or when the error path inappropriately releases a reference that was either already released or not yet owned by the caller.\nThe attack flow proceeds as follows: An attacker initiates an operation that triggers the creation of a temporary file via cachefiles. The process reaches the cachefiles_create_tmpfile() function. Within this function, an error condition is induced—such as a failure in file initialization, attribute setting, or memory allocation—that redirects execution flow to an error label.\nIf the error handling logic incorrectly assumes the file reference must be released but the surrounding code or a previous cleanup routine has already performed that release, the system executes a second fput(). This results in the underlying struct file's reference count being decremented below zero or becoming negative, leading to immediate memory corruption or a kernel oops (panic).\nFrom a memory management perspective, this corruption targets the kernel heap. By triggering the double fput(), an attacker could force the kernel to prematurely free a memory object while it is still in use, or free an object that has been repurposed for a different kernel structure. This creates a use-after-free scenario where subsequent kernel operations on the stale pointer allow for arbitrary data modification in kernel memory.\nSuccessful exploitation requires local access, as the cachefiles interface is typically managed via system calls that require interacting with the underlying filesystem or cache configuration. The vulnerability does not require remote network exposure, limiting the attack surface to authenticated local users or processes that can influence cache creation parameters."
}