CVE-2026-64059

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix folio->private handling in netfs_perform_write()

Under some circumstances, netfs_perform_write() doesn't correctly

manipulate folio->private between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing

to a group and pointing to a netfs_folio struct, leading to potential

multiple attachments of private data with associated folio ref leaks and

also leaks of netfs_folio structs or netfs_group refs.

Fix this by consolidating the place at which a folio is marked uptodate in

one place and having that look at what's attached to folio->private and

decide how to clean it up and then set the new group. Also, the content

shouldn't be flushed if group is NULL, even if a group is specified in the

netfs_group parameter, as that would be the case for a new folio. A

filesystem should always specify netfs_group or never specify netfs_group.

The Sashiko auto-review tool noted that it was theoretically possible that

the fpos >= ct

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References