CVE-2026-64216
- Source
- https://cve.org/CVERecord?id=CVE-2026-64216
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64216.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64216
- Downstream
- Published
- 2026-07-24T15:23:04.673Z
- Modified
- 2026-07-28T04:01:54.380388134Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix potential UAF in netfsunlockabandonedreadpages()
netfsunlockabandonedreadpages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->nounlockfolio so that it doesn't unlock a folio being read for netfsperformwrite() or netfswritebegin().
However, given that netfsunlockabandonedreadpages() is called after NETFSRREQINPROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->nounlock_folio as ownership immediately reverts to the caller.
Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfsunlockread_folio() where the same applies.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64216.json" }- References
-
- https://git.kernel.org/stable/c/3866d015f33aeedf81338dd99154703bef33faef
- https://git.kernel.org/stable/c/6080fa3ecfbb4448a3b47368629534c09b6ec750
- https://git.kernel.org/stable/c/dbe556972100fabb8e5a1b3d2163831ff07b1e8e
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64216.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64216
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git