Critical 9.8Published Jul 19, 2026

CVE-2026-64068netfs: Fix missing locking around retry adding new subreqs

Updated under an hour ago (Oct 26, 2026, 8:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 288ace2f57c9d06dd2e42bd80d03747d879a4068 before f59c4ec86ef3a9ac99706ae163a38ec28129fd76; from 288ace2f57c9d06dd2e42bd80d03747d879a4068 before d5c9d19b0ff2f7153532ac238a5e96fed2df315c; from 288ace2f57c9d06dd2e42bd80d03747d879a4068 before 393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2; from 288ace2f57c9d06dd2e42bd80d03747d879a4068 before cce18c263e9623872327ba3c956012f73c1179cc	CNA record
linux linux_kernel linux:linux_kernel	from 6.10 before 7.0.11; 7.1; 7.1; 7.1; 7.1	NVD

References

https://git.kernel.org/stable/c/f59c4ec86ef3a9ac99706ae163a38ec28129fd76
https://git.kernel.org/stable/c/d5c9d19b0ff2f7153532ac238a5e96fed2df315c
https://git.kernel.org/stable/c/393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2patch
https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179ccpatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.