Executive brief
A vulnerability in the Linux kernel's network filesystem (netfs) component could allow local users to view sensitive data that should have been cleared. When reading files that do not perfectly align with memory page sizes, the system may unlock data for an application before it has finished clearing the remaining space in memory. This race condition can result in an application seeing 'rubbish' or stale data from previous operations instead of the expected zeros at the end of a file.
Technical details
A race condition exists in `fs/netfs/read_collect.c` within the Linux kernel's netfs library. The function `netfs_read_unlock_folios()` incorrectly unlocks a folio as soon as the collected read results reach the EOF position, potentially before a subsequent 'ZERO' subrequest (intended to clear the tail of the folio) has completed. This allows a local attacker to use `mmap` to observe uncleared memory contents (stale data) in the page tail that should have been zeroed. The issue is particularly reproducible on synchronous READ operations like those in 9P. The fix involves ensuring the unlock check always considers the end of the folio rather than the end of the file. Patches are available in stable kernel branches 6.18.6 and later.
Affected products
- Linux Linux Kernel 6.14 to 6.18.6
Timeline
- 2025-12-20: disclosed: Initial patch authored by David Howells
- 2025-12-24: patched: Mainline fix committed
- 2026-01-17: patched: Stable backport committed to 6.18.y
- 2026-02-14: advisory: NVD advisory published