CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter()
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix overrun check in netfsextractuseriter()
Fix netfsextractuseriter() so that if ioviterextractpages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the risk of the memory corruption described for netfs by restricting exposure to the affected netfs operation until the kernel fix is applied (e.g., limit network filesystem usage/paths that trigger netfs_extract_user_iter() on systems).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64217?
CVE-2026-64217 has a high severity score of 7.8.
What does CVE-2026-64217 affect?
CVE-2026-64217 affects the Linux kernel, specifically related to the netfs_extract_user_iter function.
How do I fix CVE-2026-64217?
To fix CVE-2026-64217, update the Linux kernel to the latest patched version as provided by your distribution.
What are the potential impacts of CVE-2026-64217?
CVE-2026-64217 could lead to a denial of service or data corruption due to improper handling of user input.
Is CVE-2026-64217 remotely exploitable?
CVE-2026-64217 requires local access to exploit, thus it is not remotely exploitable.