CVE-2026-64064

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone

If a streaming write is made, this will leave the relevant modified folio

in a not-uptodate, but dirty state with a netfs_folio struct hung off of

folio->private indicating the dirty range. Subsequently truncating the

file such that the dirty data in the folio is removed, but the first part

of the folio theoretically remains will cause the netfs_folio struct to be

discarded... but will leave the dirty flag set.

If the folio is then read via mmap(), netfs_read_folio() will see that the

page is dirty and jump to netfs_read_gaps() to fill in the missing bits.

netfs_read_gaps(), however, expects there to be a netfs_folio struct

present and can oops because truncate removed it.

Fix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the

event that all the dirty data in the folio is erased (as nfs does).

Also add some tracepoints

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References