Skip to content
Fencer Vulns
medium 5.5

CVE-2026-64064 json

netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone

published 2026-07-19 3 mo ago modified 2026-09-03 2 mo ago also EUVD-2026-45637

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone

If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfs_folio struct hung off of folio->private indicating the dirty range. Subsequently truncating the file such that the dirty data in the folio is removed, but the first part of the folio theoretically remains will cause the netfs_folio struct to be discarded... but will leave the dirty flag set.

If the folio is then read via mmap(), netfs_read_folio() will see that the page is dirty and jump to netfs_read_gaps() to fill in the missing bits. netfs_read_gaps(), however, expects there to be a netfs_folio struct present and can oops because truncate removed it.

Fix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the event that all the dirty data in the folio is erased (as nfs does).

Also add some tracepoints to log modifications to a dirty page.

This can be reproduced with something like:

dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1 umount /xfstest.test mount /xfstest.test xfs_io -c "w 0xbbbf 0xf96c" \ -c "truncate 0xbbbf" \ -c "mmap -r 0xb000 0x11000" \ -c "mr 0xb000 0x11000" \ /xfstest.test/foo

with fscaching disabled (otherwise streaming writes are suppressed) and a change to netfs_perform_write() to disallow streaming writes if the fd is open O_RDWR:

if (//(file->f_mode & FMODE_READ) || <--- comment this out netfs_is_cache_enabled(ctx)) {

It should be reproducible even without this change, but if prevents the above trivial xfs_io command from reproducing it.

Note that the initial dd is important: the file must start out sufficiently large that the zero-point logic doesn't just clear the gaps because it knows there's nothing in the file to read yet. Unmounting and mounting is needed to clear the pagecache (there are other ways to do that that may also work).

This was initially reproduced with the generic/522 xfstest on some patches that remove the FMODE_READ restriction.

Patch / fix

  • Linux Linux 6.12.92, 6.18.34, 7.0.11, 7.1
  • linux Debian 13 6.12.94-1
  • linux Debian 14 7.0.12-1

debian advisories DEBIAN-CVE-2026-64064

  • linux Ubuntu 24.04 LTS 6.8.0-139.139
  • linux Ubuntu 26.04 LTS 7.0.0-28.28
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1064.67
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1009.9
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1067.75
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1008.8
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1062.70
  • linux-gke Ubuntu 26.04 LTS 7.0.0-1003.4

ubuntu advisories UBUNTU-CVE-2026-64064

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-rt Linux Micro 6.2 6.12.0-160000.40.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.40.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.40.1
  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.40.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.40.1.160000.2.29
  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.40.1
  • kernel-azure SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.40.1
  • kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.40.1

suse advisories SUSE-SU-2026:24422-1SUSE-SU-2026:24446-1SUSE-SU-2026:24437-1SUSE-SU-2026:24386-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.40.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.40.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.40.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.40.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.40.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.40.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.40.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.40.1

opensuse advisories openSUSE-SU-2026:22167-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-64064 updated cvss 5.5

kernel: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone

  • Red Hat Enterprise Linux 10 kernel
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.