Description
In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix cancellation of a DIO and single read subrequests

When the preparation of a new subrequest for a read fails, if the
subrequest has already been added to the stream->subrequests list, it can't
simply be put and abandoned as the collector may see it. Also, if it
hasn't been queued yet, it has two outstanding refs that both need to be
put. Both DIO read and single-read dispatch fail at this; further, both
differ in the order they do things to the way buffered read works.

Fix cancellation of both DIO-read and single-read subrequests that failed
preparation by the following steps:

(1) Harmonise all three reads (buffered, dio, single) to queue the subreq
before prepping it.

(2) Make all three call netfs_queue_read() to do the queuing.

(3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't
know the length of the subreq at this point.

(4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq
and then call netfs_read_subreq_terminated() to deal with it. This
will pass responsibility off to the collector for dealing with it.
Published: 2026-07-19
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Kernel memory corruption and instability
Action: Immediate Patch
AI Analysis

Impact

The netfs subsystem failed to correctly cancel subrequests that could not be prepared, causing dangling references and queued entries to remain in kernel data structures. This flaw can lead to unreleased resources, corrupted internal state, and kernel crashes. The weakness is represented by CWE-125 and CWE-772, reflecting that internal pointers can become invalid during cleanup.

Affected Systems

All Linux kernel builds preceding commit 5366199be46fb5 are affected. Kernel distributions that have not incorporated this patch, regardless of distribution vendor or exact kernel release, remain vulnerable.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity level, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability does not appear on the CISA KEV catalog. According to the description, exploitation would require triggering a failed read subrequest preparation; the CVE details do not confirm remote exploitation or privilege escalation capability. Successful exploitation could cause kernel instability or a denial‑of-service.

Generated by OpenCVE AI on September 3, 2026 at 18:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest kernel release that includes commit 5366199be46fb5, or backport the patch into the existing kernel and reboot into the updated image.
  • If the Netfs subsystem is not required for your environment, disable it (e.g., add `blacklist netfs` to `/etc/modprobe.d/blacklist-netfs.conf` or unload the module with `modprobe -r netfs`).
  • In the interim, monitor kernel logs for Netfs read errors or kernel panics that may indicate the vulnerability remains active; review `/var/log/kern.log` or use `dmesg` to alert on `netfs` or `read subrequest` failures.

Generated by OpenCVE AI on September 3, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8593-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8603-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8618-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8663-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8664-1 Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8728-1 Linux kernel (GCP) vulnerabilities
History

Thu, 03 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CPEs cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Sun, 19 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply be put and abandoned as the collector may see it. Also, if it hasn't been queued yet, it has two outstanding refs that both need to be put. Both DIO read and single-read dispatch fail at this; further, both differ in the order they do things to the way buffered read works. Fix cancellation of both DIO-read and single-read subrequests that failed preparation by the following steps: (1) Harmonise all three reads (buffered, dio, single) to queue the subreq before prepping it. (2) Make all three call netfs_queue_read() to do the queuing. (3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't know the length of the subreq at this point. (4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq and then call netfs_read_subreq_terminated() to deal with it. This will pass responsibility off to the collector for dealing with it.
Title netfs: Fix cancellation of a DIO and single read subrequests
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-05T12:38:53.294Z

Reserved: 2026-07-19T07:54:57.030Z

Link: CVE-2026-64069

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-19T16:17:47.483

Modified: 2026-09-03T15:33:21.440

Link: CVE-2026-64069

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64069 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T18:30:04Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-772

    Missing Release of Resource after Effective Lifetime