CVE-2026-64217 (GCVE-0-2026-64217)
Vulnerability from cvelistv5
Published
2026-07-24 15:23
Modified
2026-08-05 12:40
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened.
References
Impacted products
Vendor Product Version
Linux Linux Version: 85dd2c8ff368b1446be9febde84afe1d7aec4261
Version: 85dd2c8ff368b1446be9febde84afe1d7aec4261
Version: 85dd2c8ff368b1446be9febde84afe1d7aec4261
Version: 85dd2c8ff368b1446be9febde84afe1d7aec4261
Version: 85dd2c8ff368b1446be9febde84afe1d7aec4261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/iterator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00efe58bbdcc93272d579ca24bfc912563f4a204",
              "status": "affected",
              "version": "85dd2c8ff368b1446be9febde84afe1d7aec4261",
              "versionType": "git"
            },
            {
              "lessThan": "96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9",
              "status": "affected",
              "version": "85dd2c8ff368b1446be9febde84afe1d7aec4261",
              "versionType": "git"
            },
            {
              "lessThan": "afeb32d9bf9aaeea51d0f723a19f14afb73bd94d",
              "status": "affected",
              "version": "85dd2c8ff368b1446be9febde84afe1d7aec4261",
              "versionType": "git"
            },
            {
              "lessThan": "f48b9157f0f611fa436c360648603d5ded719b12",
              "status": "affected",
              "version": "85dd2c8ff368b1446be9febde84afe1d7aec4261",
              "versionType": "git"
            },
            {
              "lessThan": "0ef37eef83fad3542ee06db2940433ae1a92b39d",
              "status": "affected",
              "version": "85dd2c8ff368b1446be9febde84afe1d7aec4261",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/iterator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix overrun check in netfs_extract_user_iter()\n\nFix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills\npages[], then those pages don\u0027t get included in the iterator constructed at\nthe end of the function.  If there was an overfill, memory corruption has\nalready happened."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable helper is reached through local direct or unbuffered I/O against CIFS/SMB3, AFS, or 9P files. Remote peers cannot directly control the local user iterator that triggers extraction.\nAC:L - The attacker controls and can repeatedly submit the UBUF or IOVEC layout, and corruption occurs synchronously once the overfill condition is reached. No race, timing window, or victim-controlled state is required.\nPR:L - An ordinary unprivileged process with permission to access a file on an existing affected mount can reach the helper. No capability or administrative privilege is checked on the I/O path.\nUI:N - The attacker directly opens and performs I/O on the accessible file without requiring another user to act. An existing affected mount is a deployment prerequisite, not per-attack victim interaction.\nS:U - The corruption compromises the same host kernel that processes the local I/O. It does not inherently cross a VM, IOMMU, or other distinct security authority.\nC:H - The overfill writes page pointers beyond the allocated kernel buffer and the malformed bvec can subsequently access unpopulated descriptors. Exploitation of this kernel heap corruption can expose arbitrary kernel memory.\nI:H - The bug produces an out-of-bounds kernel heap write and can cause adjacent memory to be interpreted as bvec descriptors. Heap grooming could turn this into arbitrary memory modification or control-flow hijacking.\nA:H - The corruption can cause a kernel oops, panic, or hang, while aborted extraction can also leak pinned pages. An attacker can repeat the triggering I/O to sustain denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:05.203Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00efe58bbdcc93272d579ca24bfc912563f4a204"
        },
        {
          "url": "https://git.kernel.org/stable/c/96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/afeb32d9bf9aaeea51d0f723a19f14afb73bd94d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f48b9157f0f611fa436c360648603d5ded719b12"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ef37eef83fad3542ee06db2940433ae1a92b39d"
        }
      ],
      "title": "netfs: Fix overrun check in netfs_extract_user_iter()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64217",
    "datePublished": "2026-07-24T15:23:05.261Z",
    "dateReserved": "2026-07-19T15:36:31.770Z",
    "dateUpdated": "2026-08-05T12:40:05.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.