CVE-2026-64068
Description
A flaw was found in the Linux kernel's netfs component. This vulnerability arises from missing locking around the retry logic when adding new subrequests within the netfs_retry_read_subrequests() and netfs_retry_write_stream() functions. An attacker could potentially exploit this race condition, which may lead to system instability or a denial of service (DoS).
Statement
A race in netfs retry handling occurs because retry paths modify stream subrequests without holding the request spinlock while other code may inspect or update the same list. Concurrent list add or delete around retry read or write subrequests can corrupt list state or leave stale subrequest links, and the surrounding code also drops subrequest references after deletion. For the CVSS the PR:L is used for the paranoid score because a local unprivileged process with access to a mounted netfs backed filesystem may be able to trigger retry paths through normal file IO, while reliable triggering still depends on retry timing and filesystem conditions. The issue is not a generic Internet reachable network bug, but a malicious or unstable backing server may help create retry conditions. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact if list corruption turns into use after free or stale pointer use.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
