What is CVE-2026-64217?
A vulnerability was discovered in the Linux kernel's `netfs_extract_user_iter()` function where `iov_iter_extract_pages()` may overfill the `pages[]` array. This flaw could include those extra pages in the final iterator, potentially leading to data leakage or system instability. Updating the kernel is recommended.
Azərbaycanca: Linux kernel-də `netfs_extract_user_iter()` funksiyasında `iov_iter_extract_pages()` çağırışı zamanı yaranan `overrun` səhvi aşkar edilib. Bu boşluq, `pages[]` massivinə artıq doldurulan səhifələrin əsas iteratora daxil edilməsinə səbəb ola bilər ki, bu da potensial məlumat sızmasına və ya sistemin qeyri-sabit işləməsinə yol aça bilər. Kernel-i yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-125; shared vendor: Linux
FAQ2
In which Linux kernel function was CVE-2026-64217 discovered and what causes it?
The vulnerability was discovered in the `netfs_extract_user_iter()` function of the Linux kernel. It is caused by an overrun error where `iov_iter_extract_pages()` overfills the `pages[]` array.
What potential risks does CVE-2026-64217 pose?
This flaw could include the overfilled pages in the final iterator, potentially leading to data leakage or system instability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.