Executive brief
A vulnerability in the Linux kernel's network filesystem (netfs) component could lead to a system deadlock. This occurs during specific data writing operations (write-through mode) when memory-mapped reads and writes happen simultaneously. If triggered, the system or specific applications may become unresponsive, potentially disrupting operations and service availability.
Technical details
A race condition and potential deadlock exist in netfs_advance_writethrough() within the Linux kernel's netfs library. The issue stems from improper management of folio states; specifically, marking a folio for writeback before it is fully processed can cause a deadlock against concurrent mmapped reads and writes. The fix ensures that folios are always unlocked and marked dirty if not fully written, while delaying the writeback state until the folio is completely finished. The vulnerability is mitigated in practice by the caller holding inode->i_rwsem and ictx->wb_lock, but the logic error remains a stability risk. Patches have been released for various stable branches including 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux 6.10 to 7.1
Timeline
- 2026-05-12: disclosed: Initial patch submitted by David Howells
- 2026-07-19: advisory: CVE-2026-64062 published in NVD