Description
In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix missing barriers when accessing stream->subrequests locklessly

The list of subrequests attached to stream->subrequests is accessed without
locks by netfs_collect_read_results() and netfs_collect_write_results(),
and then they access subreq->flags without taking a barrier after getting
the subreq pointer from the list. Relatedly, the functions that build the
list don't use any sort of write barrier when constructing the list to make
sure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if
no lock is taken.

Fix this by:

(1) Add a new list_add_tail_release() function that uses a release barrier
to set the pointer to the new member of the list.

(2) Add a new list_first_entry_or_null_acquire() function that uses an
acquire barrier to read the pointer to the first member in a list (or
return NULL).

(3) Use list_add_tail_release() when adding a subreq to ->subrequests.

(4) Use list_first_entry_or_null_acquire() when initially accessing the
front of the list (when an item is removed, the pointer to the new
front iterm is obtained under the same lock).
Published: 2026-07-19
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel, a concurrency flaw in the netfs subsystem was discovered: list pointers and flags are accessed without proper memory barriers, allowing a race condition that can corrupt kernel data structures. If an attacker triggers the race while performing read or write operations on a netfs stream, the corrupted data could lead to arbitrary execution of code with kernel privileges.

Affected Systems

All Linux kernel installations that include the netfs filesystem are potentially vulnerable. The affected code resides in the netfs implementation of the kernel, and without a specific version range listed, any kernel revision that contains the legacy netfs implementation that does not apply the new barrier functions may be exposed.

Risk and Exploitability

The CVSS score of 9.8 denotes a high severity risk of remote code execution. The EPSS score of <1 % suggests a low exploitation probability in the current environment, and the vulnerability is not included in CISA’s KEV catalog. Based on the description, the likely attack vector is a race condition that can be triggered by concurrent access to netfs streams, inferred from the missing barrier discussion.

Generated by OpenCVE AI on July 30, 2026 at 20:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the netfs barrier fix, based on commit 293a4532c36f38458e38b8879b174ab797718b9d or later.
  • If a kernel update is not feasible immediately, disable the netfs filesystem or restrict its use to trusted workloads to eliminate the race condition surface.
  • Enable additional kernel hardening options such as CONFIG_RANDOMIZE_MEMORY or CONFIG_SLAB_FREELIST_RANDOM to make exploitation of any remaining kernel data‑structure attacks more difficult.

Generated by OpenCVE AI on July 30, 2026 at 20:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8593-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8603-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8618-1 Linux kernel vulnerabilities
History

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-366
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 19 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if no lock is taken. Fix this by: (1) Add a new list_add_tail_release() function that uses a release barrier to set the pointer to the new member of the list. (2) Add a new list_first_entry_or_null_acquire() function that uses an acquire barrier to read the pointer to the first member in a list (or return NULL). (3) Use list_add_tail_release() when adding a subreq to ->subrequests. (4) Use list_first_entry_or_null_acquire() when initially accessing the front of the list (when an item is removed, the pointer to the new front iterm is obtained under the same lock).
Title netfs: Fix missing barriers when accessing stream->subrequests locklessly
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-05T12:38:51.145Z

Reserved: 2026-07-19T07:54:57.030Z

Link: CVE-2026-64067

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64067 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T21:00:22Z

Weaknesses
  • CWE-366

    Race Condition within a Thread