In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the… (CVE-2026-64069)
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply be put and abandoned as the collector may see it. Also, if it hasn't been queued yet, it has two outstanding refs that both need to be put. Both DIO read and single-read dispatch fail at this; further, both differ in the order they do things to the way buffered read works. Fix cancellation of both DIO-read and single-read subrequests that failed preparation by the following steps: (1) Harmonise all three reads (buffered, dio, single) to queue the subreq before prepping it. (2) Make all three call netfs_queue_read() to do the queuing. (3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't know the length of the subreq at this point. (4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq and then call netfs_read_subreq_terminated() to deal with it. This will pass responsibility off to the collector for dealing with it.
AI Analysis
Technical Summary
CVE-2026-64069 addresses a flaw in the Linux kernel netfs component where failed preparation of a read subrequest (DIO or single read) was not correctly canceled. Specifically, if a subrequest was added to the stream's subrequests list but failed preparation, it could not simply be abandoned due to potential collector access. Additionally, unqueued subrequests had two outstanding references that both needed to be released. The fix involves harmonizing the queuing process for all three read types (buffered, DIO, single) by queuing before preparation, using a common queuing function, setting queuing flags independently of subrequest length, and marking failed subrequests with error flags before passing them to the collector for proper termination.
Potential Impact
The vulnerability could lead to improper handling of read subrequests in the netfs subsystem, potentially causing resource leaks or inconsistent state within the kernel's network filesystem read operations. No specific exploitation details or direct impact scenarios are provided, and no known exploits are reported in the wild.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to ensure proper handling of netfs read subrequests. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the… (CVE-2026-64069)
Description
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply be put and abandoned as the collector may see it. Also, if it hasn't been queued yet, it has two outstanding refs that both need to be put. Both DIO read and single-read dispatch fail at this; further, both differ in the order they do things to the way buffered read works. Fix cancellation of both DIO-read and single-read subrequests that failed preparation by the following steps: (1) Harmonise all three reads (buffered, dio, single) to queue the subreq before prepping it. (2) Make all three call netfs_queue_read() to do the queuing. (3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't know the length of the subreq at this point. (4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq and then call netfs_read_subreq_terminated() to deal with it. This will pass responsibility off to the collector for dealing with it.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64069 addresses a flaw in the Linux kernel netfs component where failed preparation of a read subrequest (DIO or single read) was not correctly canceled. Specifically, if a subrequest was added to the stream's subrequests list but failed preparation, it could not simply be abandoned due to potential collector access. Additionally, unqueued subrequests had two outstanding references that both needed to be released. The fix involves harmonizing the queuing process for all three read types (buffered, DIO, single) by queuing before preparation, using a common queuing function, setting queuing flags independently of subrequest length, and marking failed subrequests with error flags before passing them to the collector for proper termination.
Potential Impact
The vulnerability could lead to improper handling of read subrequests in the netfs subsystem, potentially causing resource leaks or inconsistent state within the kernel's network filesystem read operations. No specific exploitation details or direct impact scenarios are provided, and no known exploits are reported in the wild.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to ensure proper handling of netfs read subrequests. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-95rq-8wg2-8c57
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64069"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912c54c
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:52:59 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.