CVE-2026-64217

Analyzed Analyzed - Analysis Complete

Buffer Overrun Fix in Linux Kernel netfs

Publication date: 2026-07-24

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64217

EUVD

EUVD-2026-48625

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.3 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the netfs_extract_user_iter() function. The issue occurs when iov_iter_extract_pages() overfills the pages array, leading to memory corruption. The fix ensures that any overfilled pages are excluded from the iterator to prevent further corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfs subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying if the affected function netfs_extract_user_iter() is present in the running kernel. Commands like dmesg, journalctl -k, or checking kernel version with uname -a may help identify potential exposure.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause memory corruption in the Linux kernel. This might lead to system crashes, data corruption, or unauthorized access, depending on the attacker's goals and the system's configuration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory corruption issue in the Linux kernel's netfs subsystem. Compliance impacts would depend on whether the affected system processes or stores regulated data, but the vulnerability itself is not a compliance violation.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor kernel security advisories for updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-64217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70