CVE-2026-64061

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix early put of sink folio in netfsreadgaps()

Fix netfsreadgaps() to release the sink page it uses after waiting for

the request to complete.  The way the sink page is used is that an

ITER_BVEC-class iterator is created that has the gaps from the target folio

at either end, but has the sink page tiled over the middle so that a single

read op can fill in both gaps.

The bug was found by KASAN detecting a UAF on the generic/075 xfstest in

the cifsd kernel thread that handles reception of data from the TCP socket:

 BUG: KASAN: use-after-free in copyto_iter+0x48a/0xa20

 Write of size 885 at addr ffff888107f92000 by task cifsd/1285

 CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy)

 Call Trace:

  dumpstacklvl+0x5d/0x80

  print_report+0x17f/0x4f1

  kasan_report+0x100/0x1e0

  kasancheckrange+0x10f/0x1e0

  _asanmemcpy+0x3c/0x60

  copyto_iter+0x48a/0xa20

  _skbdatagram_iter+0x2c9/0x430

  skbcopydatagram_iter+0x6e/0x160

  tcprecvmsglocked+0xce0/0x1130

  tcp_recvmsg+0xeb/0x300

  inet_recvmsg+0xcf/0x3a0

  sock_recvmsg+0xea/0x100

  cifsreadvfrom_socket+0x3a6/0x4d0 [cifs]

  cifsreaditerfromsocket+0xdd/0x130 [cifs]

  cifsreadvreceive+0xaad/0xb10 [cifs]

  cifsdemultiplexthread+0x1148/0x1740 [cifs]

  kthread+0x1cf/0x210