Riskcovery

CVE-2026-64216

netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()

State
Published
Severity
9.8 Critical
Published
Jul 24, 2026
Updated
Aug 27, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()

netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin().

However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller.

Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ee4cdf7ba857a894ad1650d6ab77669cbbfa329e to before d4ae8dba90b89e7bb4d1045d1cb26afbaf13ee5cAffected
  • ee4cdf7ba857a894ad1650d6ab77669cbbfa329e to before 6080fa3ecfbb4448a3b47368629534c09b6ec750Affected
  • ee4cdf7ba857a894ad1650d6ab77669cbbfa329e to before 3866d015f33aeedf81338dd99154703bef33faefAffected
  • ee4cdf7ba857a894ad1650d6ab77669cbbfa329e to before dbe556972100fabb8e5a1b3d2163831ff07b1e8eAffected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.106 through 6.12.*Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.