CVE-2026-80897: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80897 Overview

CVE-2026-80897 is a memory management flaw in the Linux kernel's network filesystem (netfs) subsystem. The netfs_prepare_read_iterator() function batches readahead folios in a put_batch structure so folio references can be released after the I/O iterator is prepared. When rolling_buffer_load_from_ra() fails after folios have already been batched, the function returns the error without releasing the accumulated folio references. The fix releases the batch before returning the error path.

Critical Impact
Failed readahead iterator preparation leaks folio references in the netfs subsystem, potentially causing kernel memory pressure and resource exhaustion on systems using network filesystems.

Affected Products

Linux kernel netfs subsystem
Network filesystems relying on netfs helpers for readahead (for example, cifs, ceph, 9p, afs)
Distributions shipping affected upstream kernel revisions

Discovery Timeline

2026-09-04 - CVE-2026-80897 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80897

Vulnerability Analysis

The defect resides in netfs_prepare_read_iterator(), a helper used by network filesystems to build an I/O iterator for readahead operations. The function accumulates folio references in a local put_batch so callers can release them together after the iterator is fully assembled. This batching pattern amortizes reference-counting overhead across multiple folios.

The code path calls rolling_buffer_load_from_ra() to populate the rolling buffer from the readahead. When this helper fails partway through processing, control returns to the caller with an error code. The early return skips the batch release, leaving elevated reference counts on every folio previously placed into the batch.

Repeated failures during readahead can accumulate leaked folio references. Because folios cannot be freed while references remain elevated, sustained memory pressure or resource exhaustion may result. The condition is classified as a Memory Leak in kernel resource management.

Root Cause

The root cause is an incomplete error-handling path. The batching contract requires the caller to drain put_batch on every exit path, including error returns. The pre-patch implementation only drained the batch on the success path, violating the contract when rolling_buffer_load_from_ra() returned an error.

Attack Vector

No attack vector, exploitability metrics, or CWE mapping is currently published for this CVE. The condition is triggered by legitimate readahead operations that encounter iterator preparation failures. Impact is limited to kernel memory accounting and resource availability rather than confidentiality or integrity. No public proof-of-concept or in-the-wild exploitation has been reported.

The vulnerability manifests only in kernel memory management. Refer to the upstream commits for the precise diff:

Detection Methods for CVE-2026-80897

Indicators of Compromise

Gradual growth in kernel folio and page cache reference counts without corresponding user workload growth.
Repeated netfs readahead errors logged by network filesystem clients such as cifs, ceph, 9p, or afs.
Rising MemAvailable pressure on hosts that mount network filesystems, without matching user-space allocation.

Detection Strategies

Inventory Linux hosts and identify kernel versions predating the fix commits referenced above.
Correlate kernel ring buffer messages (dmesg) for netfs and network filesystem readahead errors over time.
Track /proc/meminfo and /proc/slabinfo trends on file servers and clients that heavily use network filesystems.

Monitoring Recommendations

Alert on sustained increases in kernel memory usage on systems mounting cifs, ceph, 9p, or afs shares.
Forward kernel logs to a centralized log platform and alert on repeated netfs read failure patterns.
Baseline readahead error rates per host and flag statistically significant deviations.

How to Mitigate CVE-2026-80897

Immediate Actions Required

Identify all Linux systems running kernels that predate the netfs fix commits.
Schedule kernel updates on hosts that mount network filesystems built on netfs helpers.
Prioritize file servers, container hosts, and workstations with heavy network filesystem workloads.

Patch Information

The fix releases the folio batch on the error path in netfs_prepare_read_iterator() before returning the error from rolling_buffer_load_from_ra(). Apply the upstream patches from the Kernel Git Commit 2c148a3, Kernel Git Commit 87eb3d2, and Kernel Git Commit 935e7b7 commits, or install distribution kernels that incorporate these fixes.

Workarounds

Reduce readahead window sizes on affected network filesystem mounts to lower the number of folios batched per operation.
Reboot hosts periodically to reclaim leaked folio references until patched kernels are deployed.
Where feasible, temporarily switch to local storage or alternative filesystem clients for critical workloads.

bash

# Verify running kernel version and check for the fix
uname -r

# Inspect readahead configuration for a mounted filesystem
cat /sys/class/bdi/<major>:<minor>/read_ahead_kb

# Temporarily lower readahead to reduce batch size
echo 128 | sudo tee /sys/class/bdi/<major>:<minor>/read_ahead_kb