CVE-2026-64216

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel's netfs Component

Publication date: 2026-07-24

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller. Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64216

EUVD

EUVD-2026-48624

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.12 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's netfs subsystem. It occurs in the function netfs_unlock_abandoned_read_pages() which attempts to unlock folios (file pages) that were abandoned during read operations. The issue arises because the function accesses and compares folio indices after a flag indicating ongoing operations is cleared, potentially leading to dereferencing a folio that has already been freed or is in use elsewhere.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to a use-after-free issue in the netfs subsystem. Detection requires checking the kernel version and examining kernel logs for related errors. Use commands like 'uname -a' to check the kernel version and 'dmesg | grep netfs' to look for related errors.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash, corrupt memory, or potentially execute arbitrary code with kernel privileges. If exploited, it may lead to denial-of-service conditions or unauthorized access to sensitive data on systems running vulnerable versions of the Linux kernel.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's netfs subsystem. It does not directly relate to data privacy, security controls, or compliance requirements such as GDPR or HIPAA. The impact is limited to potential system instability or crashes due to improper memory handling in the kernel.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to the latest patched version. Check your distribution's security updates or apply the kernel patch directly from the Linux kernel source. Reboot the system after applying the update to ensure the patched kernel is active.

Hi! I’m here to help you understand CVE-2026-64216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70