PT-2026-64331 · Linux · Linux

CVE-2026-64216 · Published 2026-07-24 · Updated 2026-07-24

NVD

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix potential UAF in netfs unlock abandoned read pages()

netfs unlock abandoned read pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no unlock folio so that it doesn't unlock a folio being read for netfs perform write() or netfs write begin().

However, given that netfs unlock abandoned read pages() is called after NETFS RREQ IN PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no unlock folio as ownership immediately reverts to the caller.

Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs unlock read folio() where the same applies.

Related Identifiers

CVE-2026-64216

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-64216 · Security Note
• https://git.kernel.org/stable/c/3866d015f33aeedf81338dd99154703bef33faef · Note
• https://git.kernel.org/stable/c/6080fa3ecfbb4448a3b47368629534c09b6ec750 · Note
• https://git.kernel.org/stable/c/dbe556972100fabb8e5a1b3d2163831ff07b1e8e · Note