CVE-2026-64069 Overview
CVE-2026-64069 is a Linux kernel vulnerability in the network filesystem (netfs) subsystem. The flaw affects cancellation handling for Direct I/O (DIO) and single read subrequests when subrequest preparation fails. If a subrequest has already been added to the stream->subrequests list, releasing it prematurely creates a race with the collector, and unqueued subrequests hold two outstanding references that both require release.
The issue stems from inconsistent ordering between buffered, DIO, and single-read code paths inside the netfs layer of the kernel.
Critical Impact
The vulnerability can lead to memory corruption or use-after-free conditions in the kernel when a netfs read subrequest fails preparation, exposing systems using network filesystems to potential exploitation.
Affected Products
- Linux kernel versions containing the netfs DIO and single-read dispatch code paths
- Distributions shipping affected kernel builds prior to the referenced stable commits
- Systems using network filesystems that rely on the netfs helper library (for example, cifs, 9p, afs, ceph)
Discovery Timeline
- 2026-07-19 - CVE-2026-64069 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64069
Vulnerability Analysis
The defect resides in the Linux kernel netfs library, which brokers page cache and I/O behavior for network filesystems. When a read subrequest is prepared and preparation fails, the code did not consistently release references or coordinate with the collector thread that iterates the stream->subrequests list.
DIO reads and single reads followed a different ordering than buffered reads. A failed subrequest could remain on the list while a caller performed netfs_put_subrequest(), leaving the collector to operate on freed memory. In the pre-queue failure path, two outstanding references existed, but only one was released, resulting in a reference count imbalance.
The upstream fix harmonizes all three read paths by queuing the subrequest before preparing it, routing all cancellations through netfs_queue_read(), setting NETFS_RREQ_ALL_QUEUED independently of queuing, and calling netfs_read_subreq_terminated() with NETFS_SREQ_FAILED so the collector owns termination.
Root Cause
The root cause is inconsistent subrequest lifetime handling across the three netfs read dispatch paths. DIO and single-read paths released or abandoned subrequests without transferring cleanup responsibility to the collector, producing reference counting errors and unsafe list access.
Attack Vector
Triggering the flaw requires inducing preparation failures for netfs read subrequests. An attacker with the ability to interact with a mounted network filesystem, or with control over the remote server backing such a mount, can craft conditions that force preparation to fail and drive the vulnerable cancellation path. The kernel commits referenced by this CVE describe the affected functions and the corrective changes.
Detection Methods for CVE-2026-64069
Indicators of Compromise
- Kernel oops, BUG, or KASAN reports referencing netfs_read_subreq_terminated, netfs_queue_read, or stream->subrequests list operations
- Unexpected system panics or memory corruption on hosts using cifs, ceph, afs, 9p, or other netfs-backed filesystems
- Repeated I/O failures on network mounts followed by kernel instability
Detection Strategies
- Compare running kernel versions against the fixed commits 5366199be46f, 6f0f7ac1915a, and f73372a4c690 published on git.kernel.org
- Enable KASAN and lockdep in test environments to surface use-after-free and refcount imbalances in netfs code paths
- Monitor dmesg and journal logs for kernel warnings tied to network filesystem I/O errors
Monitoring Recommendations
- Centralize kernel logs from Linux fleets and alert on netfs or network filesystem stack traces
- Track mount points using network filesystems and correlate kernel warnings with client-side I/O errors
- Baseline expected kernel versions across the estate and flag hosts running unpatched builds
How to Mitigate CVE-2026-64069
Immediate Actions Required
- Inventory Linux hosts running network filesystem workloads and identify unpatched kernels
- Apply vendor-supplied kernel updates that include the upstream netfs cancellation fix
- Reboot systems after kernel installation to activate the patched netfs library code
Patch Information
The fix is available in the upstream Linux kernel through three commits: 5366199be46fb53de62861721d34ba816e7e440e, 6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d, and f73372a4c6900d117f8e903fe10b62692f95e6c4. See the Kernel Git Commit Change for the primary patch. Distribution maintainers backport these commits into their supported stable kernel branches.
Workarounds
- Unmount or avoid mounting network filesystems that exercise the netfs DIO and single-read paths until a patched kernel is deployed
- Restrict access to network filesystem servers to trusted networks to reduce the chance of induced preparation failures
- Where feasible, use buffered reads only on affected mounts, as buffered read paths already followed the corrected ordering
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
