CVE-2026-64061

A flaw was found in the Linux kernel's network file system (netfs). This use-after-free vulnerability occurs when the netfs_read_gaps() function prematurely releases a memory page during network read operations. A remote attacker could exploit this by sending specially crafted network traffic, leading to memory corruption. This could result in system instability (denial of service) or potentially allow for unauthorized access to sensitive information or execution of arbitrary code.

This vulnerability is rated as an Important severity flaw because kernel-level memory corruption can lead to denial of service or local privilege escalation, although successful exploitation requires specific buffered read operations over an active network filesystem connection. In typical Red Hat deployments, exposure is limited to environments actively mounting network filesystems that leverage the netfs subsystem, such as CIFS. Earlier versions, including Red Hat Enterprise Linux 7, 8, and 9, are not affected because they do not contain the vulnerable code introduced in newer kernel streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.