{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64061", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.030Z", "datePublished": "2026-07-19T15:39:40.913Z", "dateUpdated": "2026-07-20T13:42:56.725Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:42:56.725Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix early put of sink folio in netfs_read_gaps()\n\nFix netfs_read_gaps() to release the sink page it uses after waiting for\nthe request to complete. The way the sink page is used is that an\nITER_BVEC-class iterator is created that has the gaps from the target folio\nat either end, but has the sink page tiled over the middle so that a single\nread op can fill in both gaps.\n\nThe bug was found by KASAN detecting a UAF on the generic/075 xfstest in\nthe cifsd kernel thread that handles reception of data from the TCP socket:\n\n BUG: KASAN: use-after-free in _copy_to_iter+0x48a/0xa20\n Write of size 885 at addr ffff888107f92000 by task cifsd/1285\n CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy)\n Call Trace:\n dump_stack_lvl+0x5d/0x80\n print_report+0x17f/0x4f1\n kasan_report+0x100/0x1e0\n kasan_check_range+0x10f/0x1e0\n __asan_memcpy+0x3c/0x60\n _copy_to_iter+0x48a/0xa20\n __skb_datagram_iter+0x2c9/0x430\n skb_copy_datagram_iter+0x6e/0x160\n tcp_recvmsg_locked+0xce0/0x1130\n tcp_recvmsg+0xeb/0x300\n inet_recvmsg+0xcf/0x3a0\n sock_recvmsg+0xea/0x100\n cifs_readv_from_socket+0x3a6/0x4d0 [cifs]\n cifs_read_iter_from_socket+0xdd/0x130 [cifs]\n cifs_readv_receive+0xaad/0xb10 [cifs]\n cifs_demultiplex_thread+0x1148/0x1740 [cifs]\n kthread+0x1cf/0x210"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/buffered_read.c"], "versions": [{"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e", "lessThan": "2a39d49c8d97df8cb8fa80c10859bc1ba7358c6b", "status": "affected", "versionType": "git"}, {"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e", "lessThan": "d4f4bc87c76511cf2532448b0fa40c25e894bd7d", "status": "affected", "versionType": "git"}, {"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e", "lessThan": "412e8bad48967fd34295866636c028befd27d8b9", "status": "affected", "versionType": "git"}, {"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e", "lessThan": "3e5dd91b87a8b1450217b56a336bee315f40da7d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/buffered_read.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2a39d49c8d97df8cb8fa80c10859bc1ba7358c6b"}, {"url": "https://git.kernel.org/stable/c/d4f4bc87c76511cf2532448b0fa40c25e894bd7d"}, {"url": "https://git.kernel.org/stable/c/412e8bad48967fd34295866636c028befd27d8b9"}, {"url": "https://git.kernel.org/stable/c/3e5dd91b87a8b1450217b56a336bee315f40da7d"}], "title": "netfs: Fix early put of sink folio in netfs_read_gaps()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: netfs: Fix early put of sink folio in netfs_read_gaps()", "id": "2502584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502584"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's network file system (netfs). This use-after-free vulnerability occurs when the `netfs_read_gaps()` function prematurely releases a memory page during network read operations. A remote attacker could exploit this by sending specially crafted network traffic, leading to memory corruption. This could result in system instability (denial of service) or potentially allow for unauthorized access to sensitive information or execution of arbitrary code."], "name": "CVE-2026-64061", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64061\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64061\nhttps://lore.kernel.org/linux-cve-announce/2026071910-CVE-2026-64061-8b7f@gregkh/T"], "threat_severity": "Important"}

{}