Skip to main content

Linux Kernel EUVDEUVD-2026-48625

| CVE-2026-64217 HIGH
Out-of-bounds Write (CWE-787)
2026-07-24 Linux GHSA-782q-hrc8-fp6w
Buffer Overflow Linux Memory Corruption
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local, low-privilege access required; AC:H reflects non-trivial I/O sizing needed to precisely overfill pages[] and trigger the kernel OOB write.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 27, 2026 - 05:22 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
7.8 (HIGH)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:23 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix overrun check in netfs_extract_user_iter()

Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened.

AnalysisAI

Out-of-bounds write in the Linux kernel's netfs subsystem enables a local, low-privileged attacker to corrupt kernel memory by crafting network filesystem I/O operations that cause iov_iter_extract_pages() to overfill the pages[] array in netfs_extract_user_iter(). The memory corruption occurs before any bounds guard is applied, making this a CWE-787 write-past-end condition with kernel privilege escalation potential. No public exploit code exists and the CVE is absent from the CISA KEV catalog; EPSS is 0.17% (6th percentile), consistent with no observed active exploitation.

Technical ContextAI

The netfs subsystem, introduced around Linux kernel 6.3 (anchored to commit 85dd2c8ff368b1446be9febde84afe1d7aec4261), provides a shared network filesystem I/O layer used by NFS, Ceph, AFS, and related protocols. The function netfs_extract_user_iter() extracts pages from a user-space iov_iter into an internal pages[] array for direct I/O processing. The vulnerable call to iov_iter_extract_pages() can return more pages than the pages[] buffer was sized to hold; the overfill writes past the end of the array into adjacent kernel memory (CWE-787 out-of-bounds write) before any length check is consulted. The commit message explicitly states 'memory corruption has already happened' by the time the iterator construction reaches the guard, meaning the fix prevents downstream use of the overflow but does not retroactively prevent the initial slab/heap corruption. CPE data identifies the product as linux:linux across all affected stable branches.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1. Upstream fix commits are available at git.kernel.org/stable/c/00efe58bbdcc, 96cc3beb2390, afeb32d9bf9a, f48b9157f0f6, and 0ef37eef83fa. Ubuntu users should apply packages released under USN-8618-1. Where an immediate kernel update is not feasible, the primary compensating control is to remove or restrict network filesystem mounts (NFS, Ceph, AFS) on multi-user systems so that unprivileged users cannot reach the netfs I/O path. This is not a zero-impact mitigation - it removes legitimate NFS/Ceph access - so it should be treated as temporary. No kernel runtime flag selectively disables the netfs extraction path without unmounting.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-48625 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy