CVE-2026-72132

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Charge unstable writes by request size, not folio size

nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge and

uncharge NR_WRITEBACK/WB_WRITEBACK by folio_nr_pages(folio) once per

*request* added to or removed from a commit list. This is correct only

when a folio has a single associated request. When pg_test splits a

folio into N sub-folio requests (e.g. pNFS flexfiles striping with a

stripe unit smaller than the folio size, or plain wsize-limited

splitting), each of the N requests independently charges the whole

folio's page count, inflating the accounting by a factor of N per

folio. With large folios and small stripe units this reaches multiple

orders of magnitude: a 2 MiB folio split into 512 4 KiB requests can

charge up to 512x its real size, pushing global dirty+writeback

accounting past the system's dirty threshold and forcing every

buffered writer on the host into the hard-throttle path, includi

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References