Why does “device or resource busy” stop me from unmounting on Linux?

What this covers

Linux only refuses to unmount when something is still using the filesystem: a shell whose current directory sits inside the mount, an editor or file manager with a file open, a media player, or a background sync or indexer. The kernel will not pull the filesystem out from under them. The fix always has the same shape — identify the holder, stop it, retry — and it never requires a reboot.

Symptom

Find the process holding the mount point

This is the first move because the error is not about the drive, it is about something still using the filesystem. The check lists the PIDs, the owning user and the exact files that are open inside the mount, which lets you tell a stray shell sitting in that directory apart from a real daemon you should leave alone. If it prints nothing at all, the blocker is not a plain open file and you can move to the next diagnostic.

$ fuser -vm /media/usb

$ null

Check for open-but-deleted files

A file that was unlinked still keeps the filesystem busy as long as a process holds an open descriptor to it, so a closed-looking app or a rotated log can be the invisible holder. If the output shows paths underneath your mount point, that entry is your blocker and the unmount will keep failing until that process exits or is stopped. No matching entries means you can go straight to clearing the process.

$ sudo lsof +L1

Stop the process — gently first, then hard

Send the ordinary termination signal first so the program gets a chance to flush buffers and close its files cleanly; only if it is still alive a few seconds later should you escalate to the forced signal. You know it worked when you re-check the mount point and nothing is listed any more, which is exactly what frees the filesystem. The hard signal can throw away unsaved writes on the mounted device, so keep it as the last resort.

$ kill 12345

Kill by name when you do not want to hunt PIDs

This is handy when the holder is an application that keeps respawning child processes, or when several of your own shells are parked inside the mount and you would rather not stop them one by one. Matching on the name ends every process with that name in one shot, which is also its risk: spell it carefully, because a sloppy pattern can take down unrelated programs. Confirm the same way as before — re-check the mount point and it should report no holders left.

$ pkill firefox

How to confirm it worked

Run the unmount again on the same mount point. Success means no error and an exit status of 0, the device disappears from the mount table, and its activity light stops blinking — only then is it safe to unplug.

Undo everything

Every command above can be reverted. Run these in order to undo all of it.

$ null

Review before running — some steps may not be independent.

Sources

• pgrep, pkill, pidwait - look up, signal, or wait for processes based on name and other attributes
  man7.org · technical · 2026-09-17
  Evidence: "pkill ... will send the default signal (SIGTERM) to each process instead of listing them on stdout." The page also documents the -signal and -l/--list-signals options.
• Ubuntu Manpage: pgrep, pkill, pidwait - look up, signal, or wait for processes
  manpages.ubuntu.com · technical · 2026-09-17
  Evidence: "pkill ... will send the default signal (SIGTERM) to each process instead of listing them on stdout."
• kill - send a signal to a process
  man7.org · technical · 2026-09-17
  Evidence: kill sends signals to processes; the signal list includes "9) SIGKILL" and "1) SIGHUP", and the default signal is TERM. The -s/-<signal> options select the signal to send.
• Ubuntu Manpage: kill - terminate or signal processes
  manpages.ubuntu.com · technical · 2026-09-17
  Evidence: The kill utility sends a signal to processes by PID; the -<signal> form selects the signal, e.g. -9 (SIGKILL) and -HUP (SIGHUP); the default is SIGTERM.
• fuser(1) — identify processes using files or sockets
  man7.org · community · 2026-09-17
  Evidence: fuser -v -m DIR lists processes using the mounted filesystem
• lsof(8) - Linux manual page
  Ubuntu Manpages · technical · 2026-09-17
  Evidence: The +L1 option selects files with a link count less than one, i.e. open files that have been unlinked (deleted).
• umount(8) — unmount file systems
  man7.org · community · 2026-09-17
  Evidence: describes the EBUSY 'target is busy' condition

Last verified: 2026-09-22

Related guides