CVE-2026-64216: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64216 Overview

CVE-2026-64216 is a use-after-free (UAF) vulnerability in the Linux kernel's network filesystem (netfs) subsystem. The flaw resides in the netfs_unlock_abandoned_read_pages() function, which accesses folio indexes after the NETFS_RREQ_IN_PROGRESS flag has been cleared. Once that flag is cleared, ownership of the folio specified by ->no_unlock_folio reverts to the caller, meaning the netfs code no longer holds a valid reference. Accessing the folio index at that point can dereference freed memory. The same pattern was also fixed in netfs_unlock_read_folio(). This condition affects kernel read paths tied to netfs_perform_write() and netfs_write_begin().

Critical Impact
A use-after-free in a kernel filesystem code path can lead to memory corruption, kernel crashes, information disclosure, or privilege escalation on affected Linux systems.

Affected Products

Linux kernel netfs subsystem (upstream)
Kernel versions containing netfs_unlock_abandoned_read_pages() prior to the referenced stable commits
Distributions shipping kernels based on the affected mainline versions

Discovery Timeline

2026-07-24 - CVE-2026-64216 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64216

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the Linux kernel's netfs subsystem. The function netfs_unlock_abandoned_read_pages() iterates over folios in a read request (rreq) and unlocks them, skipping the folio identified by rreq->no_unlock_folio because that folio is being read on behalf of netfs_perform_write() or netfs_write_begin(). The comparison uses the folio index rather than the folio pointer itself.

The order of operations creates the unsafe window. netfs_unlock_abandoned_read_pages() runs after NETFS_RREQ_IN_PROGRESS is cleared. Clearing that flag returns ownership of the ->no_unlock_folio back to the caller, which may free or reuse the folio. When the netfs code then dereferences the folio to read its index for comparison, it touches memory it no longer owns.

The upstream fix, applied in commits 3866d015f33a, 6080fa3ecfbb, and dbe556972100, replaces the index-based comparison with a stored folio pointer captured before ownership reverts. The same correction is applied to netfs_unlock_read_folio().

Root Cause

The root cause is an ordering defect between synchronization state and memory access. The NETFS_RREQ_IN_PROGRESS flag is cleared before the code finishes dereferencing folios it does not own. Using a stored folio pointer captured under the correct synchronization state removes the need to dereference the potentially freed folio.

Attack Vector

Triggering the flaw requires local activity that exercises netfs read paths interleaved with writes, such as workloads that generate concurrent netfs_perform_write() or netfs_write_begin() calls against network filesystems using the netfs helper library (for example, AFS, Ceph, 9p, CIFS). Successful exploitation depends on winning the race between ownership reversion and the dereference in netfs_unlock_abandoned_read_pages().

See the upstream fixes for technical context: Kernel.org Commit 3866d0, Kernel.org Commit 6080fa, and Kernel.org Commit dbe556.

Detection Methods for CVE-2026-64216

Indicators of Compromise

Unexpected kernel oops or panics referencing netfs_unlock_abandoned_read_pages or netfs_unlock_read_folio in stack traces
KASAN reports flagging use-after-free reads on folio structures during netfs read/write operations
Repeated crashes on hosts mounting network filesystems that use the netfs library (AFS, Ceph, 9p, CIFS)

Detection Strategies

Enable KASAN on kernel builds used in test environments to surface UAF conditions in netfs paths
Compare running kernel versions against the fixed commits 3866d015f33a, 6080fa3ecfbb, and dbe556972100
Correlate crash telemetry with workloads performing concurrent reads and writes on network filesystems

Monitoring Recommendations

Forward kernel.log, dmesg, and /var/crash artifacts to a central log store for correlation
Alert on kernel panics or BUG reports containing netfs_ symbols
Track kernel package versions across Linux fleets and flag hosts running unpatched builds

How to Mitigate CVE-2026-64216

Immediate Actions Required

Inventory all Linux hosts and identify kernels containing the vulnerable netfs_unlock_abandoned_read_pages() implementation
Apply distribution kernel updates that include the upstream stable backports for this fix
Prioritize systems mounting AFS, Ceph, 9p, or CIFS shares that use the netfs helper library

Patch Information

The upstream fix stores the no_unlock_folio pointer and uses it directly instead of dereferencing folios to read their index after NETFS_RREQ_IN_PROGRESS is cleared. The fix is available in the following stable commits: 3866d015f33aeedf81338dd99154703bef33faef, 6080fa3ecfbb4448a3b47368629534c09b6ec750, and dbe556972100fabb8e5a1b3d2163831ff07b1e8e. Rebuild or update to a kernel package incorporating these commits.

Workarounds

Where patching is not immediately possible, avoid mounting network filesystems that rely on the netfs helper library on exposed hosts
Restrict local user access on affected systems to reduce the surface for triggering the race condition
Monitor kernel logs for netfs-related crashes and reboot affected hosts to clear any corrupted state

bash

# Verify the running kernel version and check for fixed commits
uname -r

# Debian/Ubuntu: upgrade the kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)

# RHEL/CentOS/Fedora: upgrade the kernel package
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot