PT-2026-64331 · Linux · Linux

CVE-2026-64216 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix potential UAF in netfs unlock abandoned read pages()

netfs unlock abandoned read pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no unlock folio so that it doesn't unlock a folio being read for netfs perform write() or netfs write begin().

However, given that netfs unlock abandoned read pages() is called after NETFS RREQ IN PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no unlock folio as ownership immediately reverts to the caller.

Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs unlock read folio() where the same applies.

Identificadores relacionados

CVE-2026-64216

Produtos afetados

Linux

Referências · 4

• https://git.kernel.org/stable/c/3866d015f33aeedf81338dd99154703bef33faef · Nota
• https://git.kernel.org/stable/c/6080fa3ecfbb4448a3b47368629534c09b6ec750 · Nota
• https://git.kernel.org/stable/c/dbe556972100fabb8e5a1b3d2163831ff07b1e8e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64216 · Nota de Segurança