Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-24T00:00:00 kernel: Kernel: netfs Use-After-Free vulnerability allows local denial of service and memory corruption 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-825

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller. Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies.

A flaw was found in the `netfs` component of the Linux kernel. A local user, by interacting with a mounted `netfs` filesystem, could trigger a Use-After-Free (UAF) vulnerability. This flaw occurs when the system attempts to unlock abandoned read pages, potentially leading to a kernel crash and a denial of service. In some cases, this could also result in memory corruption, allowing for information disclosure or data manipulation.

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat Hardened Images Not affected erlang27 https://www.cve.org/CVERecord?id=CVE-2026-64216 https://nvd.nist.gov/vuln/detail/CVE-2026-64216 https://lore.kernel.org/linux-cve-announce/2026072415-CVE-2026-64216-bc28@gregkh/T