CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix potential UAF in netfsunlockabandonedreadpages()
netfsunlockabandonedreadpages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->nounlockfolio so that it doesn't unlock a folio being read for netfsperformwrite() or netfswritebegin().
However, given that netfsunlockabandonedreadpages() is called after NETFSRREQINPROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->nounlockfolio as ownership immediately reverts to the caller.
Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfsunlockreadfolio() where the same applies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the netfs implementation so netfs_unlock_abandoned_read_pages() stores the folio pointer (->no_unlock_folio) and compares/uses that pointer rather than accessing the folio index; ensure NETFS_RREQ_IN_PROGRESS clearing does not cause dereference/unlock of the one folio specified by ->no_unlock_folio when the RREQ is not allowed to unlock.
Linux kernel netfs (function netfs_unlock_abandoned_read_pages) netfs rreq no-unlock folio handling = store the folio pointer and use that rather than the folio index; compare/unlock logic uses ->no_unlock_folio to avoid dereferencing the forbidden folio
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64216?
The severity of CVE-2026-64216 is critical with a CVSS score of 9.8.
How do I fix CVE-2026-64216?
To fix CVE-2026-64216, upgrade to the latest version of the Linux kernel that contains the patch for this vulnerability.
What type of vulnerability is CVE-2026-64216?
CVE-2026-64216 is a use-after-free (UAF) vulnerability affecting the netfs component in the Linux kernel.
Which software is affected by CVE-2026-64216?
CVE-2026-64216 affects the Linux kernel.
When was CVE-2026-64216 published?
CVE-2026-64216 was published on July 24, 2026.