{"id":"CVE-2026-64067","revision":"f67743ed94984df5ba0cf999c8d32144","records":[{"revision":"f67743ed94984df5ba0cf999c8d32144","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64067","aliases":[],"title":"netfs: Fix missing barriers when accessing stream->subrequests locklessly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix missing barriers when accessing stream->subrequests locklessly\n\nThe list of subrequests attached to stream->subrequests is accessed without\nlocks by netfs_collect_read_results() and netfs_collect_write_results(),\nand then they access subreq->flags without taking a barrier after getting\nthe subreq pointer from the list.  Relatedly, the functions that build the\nlist don't use any sort of write barrier when constructing the list to make\nsure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if\nno lock is taken.\n\nFix this by:\n\n (1) Add a new list_add_tail_release() function that uses a release barrier\n     to set the pointer to the new member of the list.\n\n (2) Add a new list_first_entry_or_null_acquire() function that uses an\n     acquire barrier to read the pointer to the first member in a list (or\n     return NULL).\n\n (3) Use list_add_tail_release() when adding a subreq to ->subrequests.\n\n (4) Use list_first_entry_or_null_acquire() when initially accessing the\n     front of the list (when an item is removed, the pointer to the new\n     front iterm is obtained under the same lock).","state":0,"publishedAt":"2026-07-19T15:39:44.66+00:00","modifiedAt":"2026-10-15T10:08:00.358+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/netfs/buffered_read.c\",\n                        \"fs/netfs/misc.c\",\n                        \"fs/netfs/read_collect.c\",\n                        \"fs/netfs/write_collect.c\",\n                        \"fs/netfs/write_issue.c\",\n                        \"include/linux/list.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"288ace2f57c9d06dd2e42bd80d03747d879a4068\",\n                            \"lessThan\": \"f048f297d93fdb19d72d01d22f04c419d8b16602\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"288ace2f57c9d06dd2e42bd80d03747d879a4068\",\n                            \"lessThan\": \"293a4532c36f38458e38b8879b174ab797718b9d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"288ace2f57c9d06dd2e42bd80d03747d879a4068\",\n                            \"lessThan\": \"b5782e2d462c028096f922abca46318cec890670\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/netfs/buffered_read.c\",\n                        \"fs/netfs/misc.c\",\n                        \"fs/netfs/read_collect.c\",\n                        \"fs/netfs/write_collect.c\",\n                        \"fs/netfs/write_issue.c\",\n                        \"include/linux/list.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.11\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/f048f297d93fdb19d72d01d22f04c419d8b16602","https://git.kernel.org/stable/c/293a4532c36f38458e38b8879b174ab797718b9d","https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64067","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64067","identifiers":["CVE-2026-64067"]},"retained":false,"historicalAffected":[]}],"coverage":[]}