{"id":"CVE-2026-64216","summary":"netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()\n\nnetfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it\nis wanting to unlock and compares that to rreq-\u003eno_unlock_folio so that it\ndoesn't unlock a folio being read for netfs_perform_write() or\nnetfs_write_begin().\n\nHowever, given that netfs_unlock_abandoned_read_pages() is called _after_\nNETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to\ndereference is the one specified by -\u003eno_unlock_folio as ownership\nimmediately reverts to the caller.\n\nFix this by storing the folio pointer instead and using that rather than\nthe index.  Also fix netfs_unlock_read_folio() where the same applies.","modified":"2026-07-28T04:01:54.380388134Z","published":"2026-07-24T15:23:04.673Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64216.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3866d015f33aeedf81338dd99154703bef33faef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6080fa3ecfbb4448a3b47368629534c09b6ec750"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dbe556972100fabb8e5a1b3d2163831ff07b1e8e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64216.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64216"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e"},{"fixed":"6080fa3ecfbb4448a3b47368629534c09b6ec750"},{"fixed":"3866d015f33aeedf81338dd99154703bef33faef"},{"fixed":"dbe556972100fabb8e5a1b3d2163831ff07b1e8e"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64216.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64216.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}