What’s Vulnerable › Vulnerabilities

CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-19 · updated 2026-10-21
• Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests.

Affected products

• Linux kernel: from 6.10 before 7.0.11; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4 — fixed in 7.0.11

How to fix

Upgrade to a fixed version: Linux kernel 7.0.11. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2
• https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc
• https://git.kernel.org/stable/c/d5c9d19b0ff2f7153532ac238a5e96fed2df315c
• https://git.kernel.org/stable/c/f59c4ec86ef3a9ac99706ae163a38ec28129fd76

Get alerted when CVE-2026-64068 or the next vulnerability affects your stack