CVE-2026-64068
CVE-2026-64068 is a critical flaw in the Linux kernel where certain retry functions added subrequests without proper locking, which could lead to full loss of confidentiality, integrity, and availability. The issue has been resolved in the kernel source, but no specific fixed version or vendor patch is documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Systems running an unpatched Linux kernel containing the affected netfs retry code. No specific vendor or product versions are listed in the provided data.
Real-world impact
A network-reachable attacker with no privileges or user interaction could exploit this missing-lock condition in the kernel's netfs retry handling to potentially crash the system or corrupt data and memory, given the critical CVSS rating (C:H/I:H/A:H).
Why this severity
CVSS 9.8 (critical) means the bug is exploitable over the network with no special access or user action, and can completely compromise the system's data, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.