{"id":15046,"date":"2026-09-04T19:02:23","date_gmt":"2026-09-04T11:02:23","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64061"},"modified":"2026-09-04T19:02:23","modified_gmt":"2026-09-04T11:02:23","slug":"cve-2026-64061","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64061","title":{"rendered":"CVE-2026-64061 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix early put"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfs: Fix early put of sink folio in netfs_read_gaps()<\/p>\n<p>Fix netfs_read_gaps() to release the sink page it uses after waiting for<br \/>\nthe request to complete.  The way the sink page is used is that an<br \/>\nITER_BVEC-class iterator is created that has the gaps from the target folio<br \/>\nat either end, but has the sink page tiled over the middle so that a single<br \/>\nread op can fill in both gaps.<\/p>\n<p>The bug was found by KASAN detecting a UAF on the generic\/075 xfstest in<br \/>\nthe cifsd kernel thread that handles reception of data from the TCP socket:<\/p>\n<p> BUG: KASAN: use-after-free in _copy_to_iter+0x48a\/0xa20<br \/>\n Write of size 885 at addr ffff888107f92000 by task cifsd\/1285<br \/>\n CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy)<br \/>\n Call Trace:<br \/>\n  dump_stack_lvl+0x5d\/0x80<br \/>\n  print_report+0x17f\/0x4f1<br \/>\n  kasan_report+0x100\/0x1e0<br \/>\n  kasan_check_range+0x10f\/0x1e0<br \/>\n  __asan_memcpy+0x3c\/0x60<br \/>\n  _copy_to_iter+0x48a\/0xa20<br \/>\n  __skb_datagram_iter+0x2c9\/0x430<br \/>\n  skb_copy_datagram_iter+0x6e\/0x160<br \/>\n  tcp_recvmsg_locked+0xce0\/0x1130<br \/>\n  tcp_recvmsg+0xeb\/0x300<br \/>\n  inet_recvmsg+0xcf\/0x3a0<br \/>\n  sock_recvmsg+0xea\/0x100<br \/>\n  cifs_readv_from_socket+0x3a6\/0x4d0 [cifs]<br \/>\n  cifs_read_iter_from_socket+0xdd\/0x130 [cifs]<br \/>\n  cifs_readv_receive+0xaad\/0xb10 [cifs]<br \/>\n  cifs_demultiplex_thread+0x1148\/0x1740 [cifs]<br \/>\n  kthread+0x1cf\/0x210<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfs: Fix early put of sink folio in netfs_read_gaps()<\/p>\n<p>Fix netfs_read_gaps() to release the sink page it uses after waiting for<br \/>\nt<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15046","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}