LiveActive security incident?Get immediate response
CVE Record

CVE-2026-64069: netfs: Fix cancellation of a DIO and single read subrequests

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply be put and abandoned as the collector may see it. Also, if it hasn't been queued yet, it has two outstanding refs that both need to be put. Both DIO read and single-read dispatch fail at this; further, both differ in the order they do things to the way buffered read works. Fix cancellation of both DIO-read and single-read subrequests that failed preparation by the following steps: (1) Harmonise all three reads (buffered, dio, single) to queue the subreq before prepping it. (2) Make all three call netfs_queue_read() to do the queuing. (3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't know the length of the subreq at this point. (4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq and then call netfs_read_subreq_terminated() to deal with it. This will pass responsibility off to the collector for dealing with it.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw in netfs read error handling. If preparing a read subrequest fails, the kernel could mishandle cancellation and references. The source rates it critical with CVSS 9.8, but does not show real-world exploitation or impact details beyond confidentiality, integrity, and availability risk.

Executive priority

Prioritize patch planning for affected Linux fleets because the source rates this critical. No active exploitation is cited, so urgency should be balanced with normal kernel rollout testing and vendor confirmation.

Technical view

The bug affects netfs cancellation paths for direct I/O and single-read subrequests after preparation failure. A subrequest already queued cannot simply be released because the collector may observe it; unqueued cases may also retain multiple references. The fix harmonizes queuing and failure termination across buffered, DIO, and single reads.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions and exercising netfs read paths, including DIO or single-read behavior. The source lists affected Linux versions including 6.14, 0, 6.18.34, 7.0.11, and 7.1, but the version data is incomplete and unusual.

Exploitation context

The provided CVE data marks KEV as false and gives no cited evidence of active exploitation, public exploit code, or exploitation method. Treat the CVSS 9.8 as a prioritization signal, not proof that exploitation is occurring.

Researcher notes

The CVE text describes a reference and cancellation correctness issue in netfs read subrequest failure handling. The supplied record does not name a CWE, concrete crash primitive, privilege boundary, affected configurations, or exploit path, so validation should focus on kernel version and fix provenance.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution vendor advisories for backported kernel packages.
  • Prioritize affected systems using netfs-backed read workloads.
  • Reduce unnecessary exposure of services relying on affected kernels.
  • Monitor vendor updates because source details are incomplete.

Validation and detection

  • Inventory running Linux kernel versions across production systems.
  • Compare kernels against vendor advisories and the listed affected versions.
  • Verify patched kernels include the referenced stable commits or backports.
  • Review workloads that use netfs, direct I/O, or single-read paths.
  • Track whether CVE or vendor records add exploitability details.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-64069 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-64069Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe2d46f2ec332533816417b60933954173f602121, e2d46f2ec332533816417b60933954173f602121, e2d46f2ec332533816417b60933954173f602121unaffected
LinuxLinux6.14, 0, 6.18.34, 7.0.11, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.