In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to… (CVE-2026-64061)
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-class iterator is created that has the gaps from the target folio at either end, but has the sink page tiled over the middle so that a single read op can fill in both gaps. The bug was found by KASAN detecting a UAF on the generic/075 xfstest in the cifsd kernel thread that handles reception of data from the TCP socket: BUG: KASAN: use-after-free in _copy_to_iter+0x48a/0xa20 Write of size 885 at addr ffff888107f92000 by task cifsd/1285 CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy) Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x17f/0x4f1 kasan_report+0x100/0x1e0 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x3c/0x60 _copy_to_iter+0x48a/0xa20 __skb_datagram_iter+0x2c9/0x430 skb_copy_datagram_iter+0x6e/0x160 tcp_recvmsg_locked+0xce0/0x1130 tcp_recvmsg+0xeb/0x300 inet_recvmsg+0xcf/0x3a0 sock_recvmsg+0xea/0x100 cifs_readv_from_socket+0x3a6/0x4d0 [cifs] cifs_read_iter_from_socket+0xdd/0x130 [cifs] cifs_readv_receive+0xaad/0xb10 [cifs] cifs_demultiplex_thread+0x1148/0x1740 [cifs] kthread+0x1cf/0x210
AI Analysis
Technical Summary
The vulnerability in the Linux kernel involves netfs_read_gaps() improperly releasing the sink page it uses before the request completes, causing a use-after-free (UAF) condition. The sink page is used as part of an iterator that covers gaps in the target folio, tiled over the middle to allow a single read operation to fill both gaps. KASAN detected this UAF during CIFS server kernel thread operations receiving data from a TCP socket, resulting in a kernel BUG report. The issue was fixed by ensuring the sink page is only released after the request completes.
Potential Impact
The use-after-free vulnerability could lead to kernel memory corruption, potentially causing system instability or crashes. While no known exploits are reported in the wild, successful exploitation could affect kernel reliability and security, particularly in systems using CIFS over TCP.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the fixed kernel version where netfs_read_gaps() properly manages the sink page lifecycle. Since no vendor advisory or patch link is provided, users should monitor official Linux kernel release notes and update accordingly. Patch status is not yet confirmed in this data — check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to… (CVE-2026-64061)
Description
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-class iterator is created that has the gaps from the target folio at either end, but has the sink page tiled over the middle so that a single read op can fill in both gaps. The bug was found by KASAN detecting a UAF on the generic/075 xfstest in the cifsd kernel thread that handles reception of data from the TCP socket: BUG: KASAN: use-after-free in _copy_to_iter+0x48a/0xa20 Write of size 885 at addr ffff888107f92000 by task cifsd/1285 CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy) Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x17f/0x4f1 kasan_report+0x100/0x1e0 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x3c/0x60 _copy_to_iter+0x48a/0xa20 __skb_datagram_iter+0x2c9/0x430 skb_copy_datagram_iter+0x6e/0x160 tcp_recvmsg_locked+0xce0/0x1130 tcp_recvmsg+0xeb/0x300 inet_recvmsg+0xcf/0x3a0 sock_recvmsg+0xea/0x100 cifs_readv_from_socket+0x3a6/0x4d0 [cifs] cifs_read_iter_from_socket+0xdd/0x130 [cifs] cifs_readv_receive+0xaad/0xb10 [cifs] cifs_demultiplex_thread+0x1148/0x1740 [cifs] kthread+0x1cf/0x210
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel involves netfs_read_gaps() improperly releasing the sink page it uses before the request completes, causing a use-after-free (UAF) condition. The sink page is used as part of an iterator that covers gaps in the target folio, tiled over the middle to allow a single read operation to fill both gaps. KASAN detected this UAF during CIFS server kernel thread operations receiving data from a TCP socket, resulting in a kernel BUG report. The issue was fixed by ensuring the sink page is only released after the request completes.
Potential Impact
The use-after-free vulnerability could lead to kernel memory corruption, potentially causing system instability or crashes. While no known exploits are reported in the wild, successful exploitation could affect kernel reliability and security, particularly in systems using CIFS over TCP.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the fixed kernel version where netfs_read_gaps() properly manages the sink page lifecycle. Since no vendor advisory or patch link is provided, users should monitor official Linux kernel release notes and update accordingly. Patch status is not yet confirmed in this data — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-89jm-xxxg-24xj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64061"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912c56b
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:53:24 UTC
Last updated: 07/20/2026, 20:32:58 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.