CVE-2026-64060 Overview
CVE-2026-64060 is a resource management flaw in the Linux kernel's network filesystem (netfs) helper subsystem. The vulnerability resides in netfs_write_begin(), where the function fails to release its reference on the request object when netfs_wait_for_read() returns an error. Each failed write-begin path leaks a reference count, which prevents the associated request structure from being freed. Over time, repeated errors on network filesystems using the netfs library can exhaust kernel memory. The issue has been resolved upstream through commits merged into the stable kernel tree.
Critical Impact
Repeated error conditions in netfs_write_begin() leak request references, leading to kernel memory exhaustion and potential denial of service on affected Linux systems.
Affected Products
- Linux kernel versions containing the netfs helper library with the unfixed netfs_write_begin() error path
- Network filesystems built on the netfs library (including AFS, Ceph, 9p, and CIFS/SMB clients)
- Distributions shipping affected stable kernels prior to the referenced patch commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64060 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64060
Vulnerability Analysis
The Linux kernel's netfs library provides shared helpers for network filesystems that handle buffered reads, writes, and caching. netfs_write_begin() prepares a folio for a buffered write operation and may need to read data first to complete a partial-page write. To do so, it allocates a netfs_io_request structure and increments its reference count.
When the helper calls netfs_wait_for_read() and that call returns an error, the original code path exits without decrementing the reference it holds on the request. The request structure therefore remains allocated indefinitely. Each subsequent failure adds another orphaned request to kernel memory.
This flaw is a Memory Leak class issue. It does not permit code execution or privilege escalation, but sustained exploitation degrades system stability. The EPSS score is 0.166% (6.2 percentile), reflecting low likelihood of active exploitation in the wild.
Root Cause
The root cause is missing cleanup in an error branch. netfs_write_begin() acquires a reference on the netfs_io_request object before waiting for the read to complete. The error return path from netfs_wait_for_read() bypassed the netfs_put_request() call, leaving the reference count elevated and the object unreclaimable.
Attack Vector
Triggering the leak requires conditions that cause netfs_wait_for_read() to return an error. These include network interruptions, server-side failures, permission errors, or forced unmounts during read-modify-write cycles on netfs-backed filesystems. A local user with access to a network mount can repeatedly induce errors to accumulate leaked references. No verified public exploit or proof-of-concept is available for this issue.
The fix, applied in kernel commits 22ae28aa, 28686d6d, and 5046a34f, adds the missing reference release on the error path. See the Kernel Git Commit 22ae28a for the upstream patch.
Detection Methods for CVE-2026-64060
Indicators of Compromise
- Sustained growth in kernel slab allocations for netfs_io_request objects visible in /proc/slabinfo
- Repeated I/O error log entries from network filesystems (AFS, Ceph, 9p, CIFS) preceding memory pressure events
- Unexplained increases in kernel SUnreclaim memory reported in /proc/meminfo
Detection Strategies
- Compare running kernel versions against the fixed commits listed in the vendor advisory to identify unpatched hosts
- Correlate netfs error log messages with slab allocation trends over time to surface leak patterns
- Track kernel memory usage baselines on servers hosting network filesystem workloads and alert on sustained upward drift
Monitoring Recommendations
- Ingest dmesg and /var/log/kern.log into a centralized logging platform to search for netfs error signatures
- Monitor per-host kernel memory metrics with alerting on abnormal Slab and SUnreclaim growth
- Audit mount tables to inventory systems using netfs-based filesystems that require prioritized patching
How to Mitigate CVE-2026-64060
Immediate Actions Required
- Identify all Linux hosts running netfs-based network filesystems and confirm current kernel versions
- Apply the stable kernel updates containing commits 22ae28aa, 28686d6d, and 5046a34f from the upstream tree
- Reboot patched hosts to load the fixed kernel and clear any accumulated leaked request objects
Patch Information
The fix is available in the upstream Linux stable tree. Reference the three merged commits: Kernel Git Commit 22ae28a, Kernel Git Commit 28686d6, and Kernel Git Commit 5046a34. Distribution vendors will backport these changes into their supported kernel packages. Apply distribution updates through standard package management once available.
Workarounds
- Where patching is delayed, minimize error conditions on netfs mounts by stabilizing network paths and server availability
- Schedule periodic reboots on long-running hosts with heavy netfs workloads to reclaim leaked kernel memory
- Restrict local user access on hosts where uncontrolled error induction on network mounts is a concern
# Verify running kernel version and check for fixed commits
uname -r
# Inspect netfs-related slab allocations for signs of leak
grep netfs /proc/slabinfo
# Review recent netfs error messages in the kernel log
dmesg | grep -iE 'netfs|afs|ceph|cifs' | tail -50
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
