CVE-2026-64068

A flaw was found in the Linux kernel's netfs component. This vulnerability arises from missing locking around the retry logic when adding new subrequests within the netfs_retry_read_subrequests() and netfs_retry_write_stream() functions. An attacker could potentially exploit this race condition, which may lead to system instability or a denial of service (DoS).

A race in netfs retry handling occurs because retry paths modify stream subrequests without holding the request spinlock while other code may inspect or update the same list. Concurrent list add or delete around retry read or write subrequests can corrupt list state or leave stale subrequest links, and the surrounding code also drops subrequest references after deletion. For the CVSS the PR:L is used for the paranoid score because a local unprivileged process with access to a mounted netfs backed filesystem may be able to trigger retry paths through normal file IO, while reliable triggering still depends on retry timing and filesystem conditions. The issue is not a generic Internet reachable network bug, but a malicious or unstable backing server may help create retry conditions. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact if list corruption turns into use after free or stale pointer use.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.