CVE-2026-64060

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel Netfs Subsystem

Publication date: 2026-07-19

Last updated on: 2026-09-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfs_write_begin() error handling Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-09-02

Generated

2026-09-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64060

EUVD

EUVD-2026-45633

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.18 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the netfs_write_begin() function. When an error occurs during file read operations, the function fails to properly release a reference to a request object, causing it to leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfs subsystem and may not have direct network detection methods. Check kernel logs for errors related to netfs_write_begin() or request leaks using commands like dmesg | grep netfs or journalctl -k | grep netfs.

Impact Analysis

This vulnerability could lead to resource exhaustion over time as leaked request objects consume memory. This may cause system performance degradation or crashes in applications relying on the netfs subsystem.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a memory leak in the Linux kernel's netfs_write_begin() function. Compliance impacts would depend on specific implementations and whether the leak leads to data exposure or system instability.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-64060. Monitor kernel logs for related errors and apply patches promptly if available.

Hi! I’m here to help you understand CVE-2026-64060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70