---
id: CVE-2026-64217
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfs: Fix overrun check in netfs_extract_user_iter()

  Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills
  pages[], then those pages don't get i…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfs: Fix overrun check in netfs_extract_user_iter()

  Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills
  pages[], then those pages don't get i…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-07-24'
updated: '2026-07-27'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64217'
references:
  - url: 'https://git.kernel.org/stable/c/00efe58bbdcc93272d579ca24bfc912563f4a204'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0ef37eef83fad3542ee06db2940433ae1a92b39d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/afeb32d9bf9aaeea51d0f723a19f14afb73bd94d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f48b9157f0f611fa436c360648603d5ded719b12'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64217.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64217'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2506805'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64217'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64217'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072415-CVE-2026-64217-889e@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00175
epssPercentile: 0.06155
ingestedAt: '2026-07-27T06:16:49.083Z'
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
cwe:
  - CWE-787
scores:
  nvd: 7.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix overrun check in netfs_extract_user_iter()

Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills
pages[], then those pages don't get included in the iterator constructed at
the end of the function.  If there was an overfill, memory corruption has
already happened.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64217.json)