Executive brief
A vulnerability was identified in the Linux kernel's network filesystem (netfs) component. This flaw could allow a local user to cause memory corruption, potentially leading to a system crash or unauthorized system behavior. The issue occurs when the system incorrectly handles memory page extraction during data transfers.
Technical details
A vulnerability in the Linux kernel's netfs subsystem arises from an insufficient overrun check in netfs_extract_user_iter(). When iov_iter_extract_pages() overfills the pages array, the function fails to properly exclude those pages from the resulting iterator. This leads to memory corruption because the system continues to process an iterator that has exceeded its allocated bounds. The flaw was introduced in the function designed to extract UBUF or IOVEC into a BVEC iterator. An attacker with local access could exploit this to cause a denial of service or potentially escalate privileges through memory corruption. Patches have been released for various stable branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux 6.3 to 7.1
Timeline
- 2026-05-12: patched: Initial fix commit authored
- 2026-07-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/00efe58bbdcc93272d579ca24bfc912563f4a204
- https://git.kernel.org/stable/c/0ef37eef83fad3542ee06db2940433ae1a92b39d
- https://git.kernel.org/stable/c/96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9
- https://git.kernel.org/stable/c/afeb32d9bf9aaeea51d0f723a19f14afb73bd94d
- https://git.kernel.org/stable/c/f48b9157f0f611fa436c360648603d5ded719b12