CVE-2026-64216

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()<br /> <br /> netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it<br /> is wanting to unlock and compares that to rreq-&gt;no_unlock_folio so that it<br /> doesn&amp;#39;t unlock a folio being read for netfs_perform_write() or<br /> netfs_write_begin().<br /> <br /> However, given that netfs_unlock_abandoned_read_pages() is called _after_<br /> NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it&amp;#39;s not allowed to<br /> dereference is the one specified by -&gt;no_unlock_folio as ownership<br /> immediately reverts to the caller.<br /> <br /> Fix this by storing the folio pointer instead and using that rather than<br /> the index. Also fix netfs_unlock_read_folio() where the same applies.