CVE-2026-64159

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix zeropoint update where i_size > remote_i_size

Fix the update of the zero point[*] by netfs_release_folio() when there is

uncommitted data in the pagecache beyond the folio being released but the

on-server EOF is in this folio (ie. i_size > remote_i_size). The update

needs to limit zero_point to remote_i_size, not i_size as i_size is a local

phenomenon reflecting updates made locally to the pagecache, not stuff

written to the server. remote_i_size tracks the server's i_size.

[*] The zero point is the file position from which we can assume that the

server will just return zeros, so we can avoid generating reads.

Note that netfs_invalidate_folio() probably doesn't need fixing as

zero_point should be updated by setattr after truncation or fallocate.

Found with:

fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \

/xfstest.test/junk --replay-ops=junk.fsxops

using the following as junk.fsxops:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References