CVE-2026-64069

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64069", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.030Z", "datePublished": "2026-07-19T15:39:45.932Z", "dateUpdated": "2026-08-05T12:38:53.294Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:53.294Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix cancellation of a DIO and single read subrequests\n\nWhen the preparation of a new subrequest for a read fails, if the\nsubrequest has already been added to the stream->subrequests list, it can't\nsimply be put and abandoned as the collector may see it. Also, if it\nhasn't been queued yet, it has two outstanding refs that both need to be\nput. Both DIO read and single-read dispatch fail at this; further, both\ndiffer in the order they do things to the way buffered read works.\n\nFix cancellation of both DIO-read and single-read subrequests that failed\npreparation by the following steps:\n\n (1) Harmonise all three reads (buffered, dio, single) to queue the subreq\n before prepping it.\n\n (2) Make all three call netfs_queue_read() to do the queuing.\n\n (3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't\n know the length of the subreq at this point.\n\n (4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq\n and then call netfs_read_subreq_terminated() to deal with it. This\n will pass responsibility off to the collector for dealing with it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the netfs client read path used by CIFS/SMB, 9p, AFS, and Ceph when serving network-backed I/O; a malicious remote filesystem server can induce prepare_read failure during multi-chunk O_DIRECT reads, exercising the faulty cancellation without local shell access on the victim.\nAC:L - An attacker controlling the remote server and read parameters (O_DIRECT, read size spanning multiple subrequests) can reliably trigger prepare_read failure after partial submission, creating the stuck subrequest state; no rare memory layout or victim timing is required.\nPR:N - Exploitation requires only that some client process perform a read on a mounted network filesystem share, which needs no elevated Linux privileges; SMB authentication to the attacker-controlled server does not constitute privilege on the victim host.\nUI:N - In common enterprise deployments the CIFS/AFS/9p mount is already established, so a remote attacker can trigger the bug through normal file access over the mount without additional victim actions beyond routine use of the share.\nS:U - Impact is confined to the kernel host processing the network filesystem read; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:H - Improper subrequest cancellation leaves queued objects visible to the collector with incorrect refcounting, creating a use-after-free class lifecycle bug where freed or inconsistent subrequest memory may be accessed during collection.\nI:H - The refcount/collector desynchronization can corrupt kernel heap metadata and, in the DIO path, prematurely calls inode_dio_end() while subrequests remain active, enabling memory corruption primitives beyond a simple error return.\nA:H - A failed mid-read cancellation leaves subrequests stuck with NETFS_SREQ_IN_PROGRESS set, causing netfs_wait_for_read() to sleep in TASK_UNINTERRUPTIBLE indefinitely and producing a severe kernel-level denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/buffered_read.c", "fs/netfs/direct_read.c", "fs/netfs/internal.h", "fs/netfs/read_collect.c", "fs/netfs/read_single.c"], "versions": [{"version": "e2d46f2ec332533816417b60933954173f602121", "lessThan": "5366199be46fb53de62861721d34ba816e7e440e", "status": "affected", "versionType": "git"}, {"version": "e2d46f2ec332533816417b60933954173f602121", "lessThan": "f73372a4c6900d117f8e903fe10b62692f95e6c4", "status": "affected", "versionType": "git"}, {"version": "e2d46f2ec332533816417b60933954173f602121", "lessThan": "6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/buffered_read.c", "fs/netfs/direct_read.c", "fs/netfs/internal.h", "fs/netfs/read_collect.c", "fs/netfs/read_single.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5366199be46fb53de62861721d34ba816e7e440e"}, {"url": "https://git.kernel.org/stable/c/f73372a4c6900d117f8e903fe10b62692f95e6c4"}, {"url": "https://git.kernel.org/stable/c/6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d"}], "title": "netfs: Fix cancellation of a DIO and single read subrequests", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/buffered_read.c", "fs/netfs/direct_read.c", "fs/netfs/internal.h", "fs/netfs/read_collect.c", "fs/netfs/read_single.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5366199be46fb53de62861721d34ba816e7e440e", "status": "affected", "version": "e2d46f2ec332533816417b60933954173f602121", "versionType": "git"}, {"lessThan": "f73372a4c6900d117f8e903fe10b62692f95e6c4", "status": "affected", "version": "e2d46f2ec332533816417b60933954173f602121", "versionType": "git"}, {"lessThan": "6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d", "status": "affected", "version": "e2d46f2ec332533816417b60933954173f602121", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/netfs/buffered_read.c", "fs/netfs/direct_read.c", "fs/netfs/internal.h", "fs/netfs/read_collect.c", "fs/netfs/read_single.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D570635-8F4B-4658-A288-87338DAB4680", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix cancellation of a DIO and single read subrequests\n\nWhen the preparation of a new subrequest for a read fails, if the\nsubrequest has already been added to the stream->subrequests list, it can't\nsimply be put and abandoned as the collector may see it. Also, if it\nhasn't been queued yet, it has two outstanding refs that both need to be\nput. Both DIO read and single-read dispatch fail at this; further, both\ndiffer in the order they do things to the way buffered read works.\n\nFix cancellation of both DIO-read and single-read subrequests that failed\npreparation by the following steps:\n\n (1) Harmonise all three reads (buffered, dio, single) to queue the subreq\n before prepping it.\n\n (2) Make all three call netfs_queue_read() to do the queuing.\n\n (3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't\n know the length of the subreq at this point.\n\n (4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq\n and then call netfs_read_subreq_terminated() to deal with it. This\n will pass responsibility off to the collector for dealing with it."}], "id": "CVE-2026-64069", "lastModified": "2026-09-03T15:33:21.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:47.483", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5366199be46fb53de62861721d34ba816e7e440e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f73372a4c6900d117f8e903fe10b62692f95e6c4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfs: Fix cancellation of a DIO and single read subrequests", "id": "2502566", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502566"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's netfs component. When a direct I/O (DIO) or single read subrequest fails during preparation, the subrequest may not be properly cancelled. This can lead to resource leaks or unexpected behavior, potentially impacting system stability."], "name": "CVE-2026-64069", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64069\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64069\nhttps://lore.kernel.org/linux-cve-announce/2026071912-CVE-2026-64069-0000@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2d46f2ec332533816417b60933954173f602121,5366199be46fb53de62861721d34ba816e7e440e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2d46f2ec332533816417b60933954173f602121,f73372a4c6900d117f8e903fe10b62692f95e6c4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2d46f2ec332533816417b60933954173f602121,6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T09:15:02.490869+00:00", "updated": "2026-09-03T18:30:04.952095+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}