CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-24 · updated 2026-08-27
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller. Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies.

Affected products

Linux kernel: from 6.12 before 6.18.34; from 6.19 before 7.0.11; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4 — fixed in 6.18.34, 7.0.11

How to fix

Upgrade to a fixed version: Linux kernel 6.18.34, 7.0.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64216 or the next vulnerability affects your stack