What’s Vulnerable › Vulnerabilities

CVE-2026-64040: cachefiles: Fix error return when vfs_mkdir() fails

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-19 · updated 2026-10-15
• Weakness: CWE-252

Description

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfs_mkdir() fails When vfs_mkdir() fails, the error code is not extracted from the returned error pointer. This causes mkdir_error to be reached with ret=0, which leads to returning ERR_PTR(0) (NULL) instead of a proper error pointer. Fix this by extracting the error code from the error pointer when vfs_mkdir() fails.

Affected products

• Linux kernel: from 6.15 before 7.0.11; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4 — fixed in 7.0.11

How to fix

Upgrade to a fixed version: Linux kernel 7.0.11. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0940108d27c6995e02819ff832be11892f0b208b
• https://git.kernel.org/stable/c/86f4c1586418d50203ee8d76cba5d7b148719a32
• https://git.kernel.org/stable/c/8a220d1c312c66194f4a33dd52d1fba42bc2b341

Get alerted when CVE-2026-64040 or the next vulnerability affects your stack