CVE-2026-72315

This CVE exposes a fundamental mismatch between how CIFS manages dentry lifecycle and how the netfs library dispatches deferred work. The original fix (commit c68337442f03) flushed the deferredclose_wq to prevent the busy-dentry warning during umount, but that workqueue only handles a specific code path. Direct I/O writes use the netfs library's internal dispatch through system_dfl_wq — a system-wide workqueue that CIFS cannot legitimately flush. The original fix addressed one symptom, not the architecture. The race condition manifests because shrink_dcache_for_umount() walks the dentry tree and triggers warnings while deferred work items dispatched to system_dfl_wq still hold references to dentries. The ictx->io_count wait in cifs_evict_inode() was supposed to provide this protection, but it lives too late in the eviction sequence — after shrink_dcache_for_umount() has already complained. The fix requires the wait to happen before kill_anon_super(), not inside inode eviction. The correct approach introduces a per-superblock reference counter that tracks all in-flight requests capable of holding dentry-backed file references. This counter must be incremented in every cifs_init_request() path that could touch dentry-backed files and decremented in cifs_free_request(). The wait on this counter in cifs_kill_sb() ensures umount blocks until all such requests complete, regardless of which workqueue they use internally. Three things to verify: First, audit that every code path touching dentry-backed files increments the counter in cifs_init_request() — any path that could trigger _cifsFileInfo_put must be captured. Second, check whether the existing ictx->io_count mechanism interacts with the new per-sb counter or could race with it; if it's now redundant, it should be removed rather than left as dead code. Third, confirm whether reads through the DIO path have the same issue or if write completion sequencing creates a unique window. The deeper risk: this fix assumes CIFS can track every path that decrements cfile->count. If netfs adds new dispatch mechanisms or if other decrement paths exist outside the request lifecycle, the race can recur. Treat the counter increment/decrement protocol as permanent architecture — every future code path that could trigger _cifsFileInfo_put must follow it, or the regression window reopens silently.

Reviewed through automated stages and approved by a human before publication.