CVE-2026-64185

Description

In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfs_update_group() is called for a named group and create_files() fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on the group directory. In the update path, kn was obtained via kernfs_find_and_get() and refers to a directory that already existed before this call. Removing it silently destroys a sysfs group that the caller did not create. Only remove the directory if we created it ourselves. On update failure the directory remains as it is left empty by remove_files() inside create_files(), but can be repopulated by a retry.

Is your site exposed to CVE-2026-64185?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0017

Probability of exploitation

0.06%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/14f2c14ae86c4af17a0a9f8ab46dacf2d5fd1d8a https://git.kernel.org/stable/c/237557b8a81ab948e8332f7c0058e758f081c0a3 https://git.kernel.org/stable/c/31527d80234caf83dc96ad478645e57df9de4472 https://git.kernel.org/stable/c/48fa96538bd2868034d33429e4565fda384d0736 https://git.kernel.org/stable/c/57b285e0368290aa55f79ba11419b96d0ebdb418 https://git.kernel.org/stable/c/708f6926f61f71e09b5e9fd668b9882ccd46e69f https://git.kernel.org/stable/c/c5e125c828b701afaf7493b42a14aa89362ff36d https://git.kernel.org/stable/c/ccadd32cc1263802a5969c9efe0e96225450428c

Frequently Asked Questions

What is CVE-2026-64185? +

In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfs_update_group() is called for a named group and create_files() fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on the group directory. In the update path, kn was obtained via kernfs_find_and_get() and refers to a directory that already existed before this call. Removing it silently destroys a sysfs group that the caller did not create. Only remove the directory if we created it ourselves. On update failure the directory remains as it is left empty by remove_files() inside create_files(), but can be repopulated by a retry.

How do I check if I'm vulnerable to CVE-2026-64185? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.