Linux Kernel CVE-2026-64060

The Linux kernel netfs subsystem (cpe:2.3:a:linux:linux) provides a generic read/write helper layer shared across network filesystems including NFS, Ceph, AFS, and Samba/CIFS. The netfs_write_begin() function implements the folio-based write-start path: it populates the page cache by waiting for a pending read via netfs_wait_for_read(). When that wait returns an error - for example due to a network fault or server-side failure - the function's error path returns without releasing the reference it holds on the netfs_io_request object. CWE-401 (Missing Release of Memory after Effective Lifetime) describes this class precisely: the request allocation remains pinned beyond its useful lifetime, leaking memory in an unbounded fashion across repeated error events. The introduced-by commit is 4090b31422a6f24dfe701e31ffec7ba5804a7e2f; the fix corrects the refcount drop in all relevant error branches.