CVE-2026-64217

A flaw was found in the Linux kernel's netfs component. A local user can exploit this vulnerability by performing specific file I/O operations on a netfs-backed mount, leading to an overrun in the netfs_extract_user_iter() function. This memory corruption can cause a kernel crash, resulting in a Denial of Service (DoS). In some cases, it may also lead to privilege escalation by allowing unauthorized access to sensitive kernel memory.

A flaw in the Linux kernel netfs helper code, rated with an impact of IMPORTANT, affects Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The netfs_extract_user_iter() function in fs/netfs/iterator.c did not correctly handle an overfill of the pages[] array returned by iov_iter_extract_pages(); when an overfill occurred, those extra pages were still included in the iterator constructed at the end of the function, and the overfill itself means kernel memory corruption has already happened. A local user able to perform specific file I/O operations on a netfs-backed mount could trigger this flaw to crash the kernel, causing a denial of service; in some cases, the memory corruption may also allow access to sensitive kernel memory, potentially leading to privilege escalation. The vulnerable code was introduced upstream in Linux kernel 6.3, so Red Hat Enterprise Linux 6, 7, 8, and 9 do not contain the vulnerable code and are not affected. Fixes for the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams are being pursued. Red Hat scored this flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the 7.8 score in the upstream CVE record (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), because Red Hat assessed that successfully triggering the memory corruption involves high attack complexity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.