Search: CVE-2026-64061

A use-after-free vulnerability in the Linux kernel's netfs subsystem was fixed by correcting the handling of a sink page in the netfs_read_gaps() function. The flaw caused an early release of the sink folio, leading to a use-after-free detected by KASAN during CIFS data reception. This vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and specific earlier versions. The issue has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability. A patch is available and should be applied to affected systems.