Skip to main content

Linux Kernel EUVDEUVD-2026-45631

| CVE-2026-64058 HIGH
Out-of-bounds Read (CWE-125)
2026-07-19 Linux GHSA-m5w8-868m-233w
Buffer Overflow Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-priv user (AV:L/PR:L); AC:H because exploitation depends on winning a writeback/read timing race; use-after-free of kernel memory supports C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 20, 2026 - 17:11 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_read_folio() to wait on writeback

Fix netfs_read_folio() to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio->private (folio->private may get cleaned up by the collector before it clears the writeback flag).

AnalysisAI

Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.

Technical ContextAI

The netfs library is the Linux kernel's shared read/write helper layer beneath network and caching filesystems (AFS, Ceph, 9p, CIFS/SMB, and anything using fscache/cachefiles). It tracks per-folio state through the page-cache dirty and writeback flags plus a folio->private pointer holding netfs bookkeeping. The root cause is a classic race condition (CWE-362) tending toward use-after-free (CWE-416): the writeback 'collector' path can clean up and free the structure attached to folio->private before it clears the PG_writeback flag, so a concurrent netfs_read_folio() that proceeds without waiting on writeback reads a dirty flag and folio->private that no longer reflect valid state. The fix makes netfs_read_folio() block on ongoing writeback so the flags and attached private data are consistent before the read is serviced. CPE data lists only the generic cpe:2.3:a:linux:linux:*:*:* package entry, which does not pin version boundaries - those come from the stable git commits and EUVD ranges.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.18.34, 7.0.11, or 7.1 (or your distribution's backported build carrying stable commits f17b9121bb99f88188ec9be2db5da1d561f4c01b / b8271cccdd5e43cc8d738afb8b51f6ad05b1cb4b / ded0c6f1606061148c202825f7e53d711f9f84cf), published at git.kernel.org/stable/c/<commit> and referenced from https://nvd.nist.gov/vuln/detail/CVE-2026-64058. Apply the distro kernel update and reboot so the new image loads, or use livepatch/kpatch if your vendor ships this fix as a hot patch. If you cannot patch immediately, exposure is limited by not exercising netfs: avoid or unmount AFS, Ceph, 9p, and CIFS/SMB shares and disable fscache/cachefiles caching (mount without the fsc option) on affected hosts - the trade-off is loss of network-filesystem functionality and caching performance, so this is only viable where those mounts are non-essential. Restricting local shell access on multi-user systems also reduces attack surface, since exploitation requires local low-privilege execution.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45631 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy