CVE-2026-64061: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64061 Overview

CVE-2026-64061 is a use-after-free vulnerability in the Linux kernel's netfs subsystem. The flaw resides in the netfs_read_gaps() function, which releases a sink page before waiting for the associated read request to complete. Kernel Address Sanitizer (KASAN) detected the issue while running the generic/075 xfstest against a CIFS mount, where the cifsd kernel thread copied received socket data into memory that had already been freed. The bug affects filesystems that rely on the netfs read helper, notably CIFS, and manifests during TCP data reception in _copy_to_iter().

Critical Impact
A remote SMB server can trigger memory corruption in the client kernel by returning data while the sink folio has already been released, leading to kernel memory corruption.

Affected Products

Linux kernel netfs subsystem (multiple stable branches, per upstream fix commits)
Linux CIFS client (consumer of netfs_read_gaps())
Distributions shipping affected kernel versions prior to the referenced stable patches

Discovery Timeline

2026-07-19 - CVE-2026-64061 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64061

Vulnerability Analysis

The netfs_read_gaps() helper constructs an ITER_BVEC iterator that combines gap regions from the target folio with a single sink page tiled over the middle. This layout allows one read operation to fill both gaps around uncached ranges. The defective code path released the sink page too early, before the read request completed. When the network receive path later copied inbound TCP data into the iterator, the sink page memory had already been returned to the allocator.

KASAN captured the resulting write into freed memory during _copy_to_iter(), invoked from skb_copy_datagram_iter() in the cifsd reception thread. The stack trace shows the corruption occurring inside tcp_recvmsg_locked() while CIFS processed an inbound response, confirming the race between request completion and sink-page release.

Root Cause

The root cause is an ordering error in resource lifetime management. The sink folio reference count was dropped before the asynchronous read operation using that folio finished. Any subsequent write to the freed page constitutes a use-after-free [CWE-416]. The fix, applied across stable branches in commits 2a39d49, 3e5dd91, 412e8ba, and d4f4bc8, defers the put of the sink folio until after the request completes.

Attack Vector

Exploitation requires the client to issue a netfs read that produces gap regions, then receive attacker-influenced data from the remote peer. A malicious or compromised SMB server can shape response timing and content to write into the freed sink page. The impact ranges from kernel memory corruption and denial of service to potential privilege escalation, depending on what allocation reuses the freed page.

No public proof-of-concept exploit code is available. See the upstream kernel commits linked below for the exact patch diff.

Detection Methods for CVE-2026-64061

Indicators of Compromise

KASAN reports containing use-after-free in _copy_to_iter originating from cifs_readv_from_socket or cifs_demultiplex_thread
Kernel oops or panic traces referencing netfs_read_gaps in the call stack
Unexpected cifsd thread crashes during heavy CIFS read workloads

Detection Strategies

Enable KASAN on test kernels and run the generic/075 xfstest against CIFS mounts to reproduce the fault
Monitor dmesg and journal logs for BUG: KASAN or general protection fault entries referencing netfs or CIFS symbols
Inventory running kernel versions against the fixed stable releases identified in commits 2a39d49, 3e5dd91, 412e8ba, and d4f4bc8

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on repeated netfs_read_gaps or _copy_to_iter fault signatures
Track outbound SMB connections from Linux clients to untrusted or internet-exposed SMB servers
Correlate kernel crash telemetry with CIFS mount activity to identify affected hosts at scale

How to Mitigate CVE-2026-64061

Immediate Actions Required

Apply the vendor kernel update containing the upstream fix as soon as it is available for your distribution
Identify all Linux hosts using CIFS or other netfs consumers and prioritize patching
Restrict outbound SMB (TCP/445) connections to trusted servers via host and network firewalls

Patch Information

The fix is upstream in the Linux stable tree. Reference commits: Kernel Git Commit 2a39d49, Kernel Git Commit 3e5dd91, Kernel Git Commit 412e8ba, and Kernel Git Commit d4f4bc8. Rebuild or upgrade to a kernel that includes these commits and reboot affected systems.

Workarounds

Unmount CIFS shares on hosts that cannot be patched immediately and disable automatic remounting
Block egress SMB traffic to untrusted networks at the perimeter and host firewall level
Where feasible, switch affected workloads to filesystems that do not exercise the netfs_read_gaps() path until patching is complete

bash

# Verify running kernel and check for fixed commit inclusion
uname -r

# Example: block outbound SMB to untrusted destinations with nftables
sudo nft add rule inet filter output tcp dport 445 ip daddr != 10.0.0.0/8 drop

# Temporarily unmount CIFS shares pending kernel update
sudo umount -a -t cifs