{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-64059 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64059 is a medium-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64059 and fix it if it is affected.\n\nWhat it is: CVE-2026-64059 is a medium-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64059 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64059/ (Markdown: https://insights.sbomify.com/CVE-2026-64059/index.md)","id":"CVE-2026-64059","markdown":"https://insights.sbomify.com/CVE-2026-64059/index.md","name":"CVE-2026-64059","record":{"aliases":["BELL-CVE-2026-64059","DEBIAN-CVE-2026-64059","GHSA-3rfc-7v55-gmrf","UBUNTU-CVE-2026-64059"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel netfs","requires_auth":"low_privilege","summary":"A flaw in the Linux kernel netfs subsystem causes memory leaks and reference counting errors, potentially leading to denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix folio-\u003eprivate handling in netfs_perform_write()\n\nUnder some circumstances, netfs_perform_write() doesn't correctly\nmanipulate folio-\u003eprivate between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing\nto a group and pointing to a netfs_folio struct, leading to potential\nmultiple attachments of private data with associated folio ref leaks and\nalso leaks of netfs_folio structs or netfs_group refs.\n\nFix this by consolidating the place at which a folio is marked uptodate in\none place and having that look at what's attached to folio-\u003eprivate and\ndecide how to clean it up and then set the new group.  Also, the content\nshouldn't be flushed if group is NULL, even if a group is specified in the\nnetfs_group parameter, as that would be the case for a new folio.  A\nfilesystem should always specify netfs_group or never specify netfs_group.\n\nThe Sashiko auto-review tool noted that it was theoretically possible that\nthe fpos \u003e= ctx-\u003ezero_point section might leak if it modified a streaming\nwrite folio.  This is unlikely, but with a network filesystem, third party\nchanges can happen.  It also pointed out that __netfs_set_group() would\nleak if called multiple times on the same folio from the \"whole folio\nmodify section\".","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"netfs: Fix folio-\u003eprivate handling in netfs_perform_write()","id":"CVE-2026-64059","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"netfs: Fix leak of request in netfs_write_begin() error handling","id":"CVE-2026-64060"},"packages":[],"prev":{"headline":"netfs: Fix netfs_read_folio() to wait on writeback","id":"CVE-2026-64058"},"products":["Linux"],"published":"2026-07-19","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-07-19","vendors":["Linux"]},"summary":"A flaw in the Linux kernel netfs subsystem causes memory leaks and reference counting errors, potentially leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-64059/"}