Sysfs Update Vulnerability in Linux Kernel Products

CVE-2026-64185

What is CVE-2026-64185?

A vulnerability in the Linux kernel affects the sysfs update process, where a failure during the creation of files can lead to the unintended removal of an existing directory. This issue arises when the sysfs_update_group() function encounters a failure (such as -ENOMEM) and subsequently calls kernfs_remove() on a pre-existing directory. The erroneous removal leads to the destruction of a sysfs group that the caller did not initiate. To prevent this issue, the kernel should only remove directories that it has created itself, ensuring that existing directories remain intact following an update failure. This allows for a safe repopulation of files during a retry.

References