GHSA-V9GP-G328-R6M8

Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-19 18:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

sysfs: don't remove existing directory on update failure

When sysfs_update_group() is called for a named group and create_files() fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on the group directory. In the update path, kn was obtained via kernfs_find_and_get() and refers to a directory that already existed before this call. Removing it silently destroys a sysfs group that the caller did not create.

Only remove the directory if we created it ourselves. On update failure the directory remains as it is left empty by remove_files() inside create_files(), but can be repopulated by a retry.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64185"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T16:18:00Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysfs: don\u0027t remove existing directory on update failure\n\nWhen sysfs_update_group() is called for a named group and create_files()\nfails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on\nthe group directory.  In the update path, kn was obtained via\nkernfs_find_and_get() and refers to a directory that already existed\nbefore this call.  Removing it silently destroys a sysfs group that the\ncaller did not create.\n\nOnly remove the directory if we created it ourselves.  On update failure\nthe directory remains as it is left empty by remove_files() inside\ncreate_files(), but can be repopulated by a retry.",
  "id": "GHSA-v9gp-g328-r6m8",
  "modified": "2026-07-19T18:31:54Z",
  "published": "2026-07-19T18:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64185"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/14f2c14ae86c4af17a0a9f8ab46dacf2d5fd1d8a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/237557b8a81ab948e8332f7c0058e758f081c0a3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/31527d80234caf83dc96ad478645e57df9de4472"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/48fa96538bd2868034d33429e4565fda384d0736"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/57b285e0368290aa55f79ba11419b96d0ebdb418"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/708f6926f61f71e09b5e9fd668b9882ccd46e69f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c5e125c828b701afaf7493b42a14aa89362ff36d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ccadd32cc1263802a5969c9efe0e96225450428c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.