{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  smb: client: fix busy dentry warning on unmount after DIO  Commit c68337442f03 (\"cifs: Fix busy dentry used after unmounting\") fixed the issue in cifs where deferred close of a file led to a dentry reference count not being released in umount, by flushing deferredclose_wq in cifs_kill_sb() to solve it.  However, the cifs DIO path suffers from the same busy-dentry problem caused by a delayed dentry reference-count release:  \t[dio]\t\t\t[cifsd]\t\t\t[close + umount] netfs_unbuffered_write_iter_locked ... \t\t\t\tcifs_demultiplex_thread  netfs_unbuffered_write   cifs_issue_write   netfs_wait_for_in_progress_stream [1] \t\t\t\t... \t\t\t\t netfs_write_subrequest_terminated \t\t\t\t  netfs_subreq_clear_in_progress \t\t\t\t   netfs_wake_collector // wake [1] \t\t\t\t  netfs_put_subrequest  netfs_put_request   queue_work(system_dfl_wq, xxx) [2]  // dio write return\t\t\t\t\tcifs_close \t\t\t\t\t\t\t _cifsFileInfo_put \t\t\t\t\t\t\t  // cfile-\u003ecount 2-\u003e1 \t\t\t\t\t\t\t  --cfile-\u003ecount [3]  \t\t\t\t\t\t\t// umount \t\t\t\t\t\t\tcifs_kill_sb \t\t\t\t\t\t\t kill_anon_super \t\t\t\t\t\t\t  // warning triggered! \t\t\t\t\t\t\t  shrink_dcache_for_umount [4] [system_dfl_wq] [5] netfs_free_request  ...  _cifsFileInfo_put   // cfile-\u003ecount 1-\u003e0   --cfile-\u003ecount   queue_work(fileinfo_put_wq, xxx)  [fileinfo_put_wq] [6] cifsFileInfo_put_work  cifsFileInfo_put_final   dput  If the umount path is triggered before [5], it results warning: BUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test}  still in use (1) [unmount of cifs cifs]  The existing per-inode ictx-\u003eio_count wait in cifs_evict_inode() does not help: it lives in the inode eviction path, which runs after shrink_dcache_for_umount() has already warned about the busy dentries.  Fix it by adding a per-superblock outstanding-rreq counter that is incremented in cifs_init_request() and decremented in cifs_free_request(). In cifs_kill_sb(), before kill_anon_super(), wait for this counter to reach 0 - which guarantees that all cleanup_work for this sb have run and thus all relevant cfile puts are queued on fileinfo_put_wq or serverclose_wq. Then drain the workqueue so the dentry refs are dropped.  This is a targeted wait, not a flush of the system-wide system_dfl_wq.",
  "id": "DEBIAN-CVE-2026-72315",
  "modified": "2026-09-14T16:47:44.515884259Z",
  "published": "2026-08-15T06:22:04.367Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72315"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-72315"
  ]
}