CVE-2026-64061 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take steps to ensure their systems are updated. This includes reviewing system configurations, applying patches, and monitoring system logs for suspicious activity. Additionally, security teams should prioritize patching affected systems and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The vulnerability is caused by the early release of the sink folio in the netfs_read_gaps() function. An ITER_BVEC-class iterator is created with gaps from the target folio at either end, but the sink page is tiled over the middle. This allows a single read operation to fill in both gaps. However, the sink page is released before the request is completed, leading to a use-after-free error. The bug was found by KASAN detecting a UAF on the generic/075 xfstest in the cifsd kernel thread that handles reception of data from the TCP socket. The stack trace shows the sequence of function calls leading to the error. To fix this vulnerability, it is recommended to update the Linux kernel to the latest version and verify system configurations.

Defensive priority

High

Recommended defensive actions

• Update the Linux kernel to the latest version
• Verify system configurations and apply patches
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The bug was found by KASAN detecting a UAF on the generic/075 xfstest in the cifsd kernel thread that handles reception of data from the TCP socket. The stack trace shows the sequence of function calls leading to the error. This issue highlights the importance of memory management in kernel development and the value of tools like KASAN in identifying use-after-free vulnerabilities. To verify, defenders should review the Linux kernel source code, specifically the netfs_read_gaps() function, and ensure that the sink folio is not released prematurely. Additionally, reviewing system logs for similar errors and monitoring for suspicious activity can help detect potential exploitation attempts.

Official resources