Executive brief
A vulnerability was identified in the Linux kernel's network filesystem (netfs) library, which manages how data is read from and written to remote servers. Under specific conditions involving uncommitted data, the system could incorrectly track the end of a file, leading to data corruption or failed read operations. This could impact the reliability of applications relying on network-attached storage or shared filesystems.
Technical details
A logic error exists in netfs_release_folio() within the Linux kernel's netfs subsystem. When releasing a folio that contains the on-server end-of-file (EOF) but has uncommitted local data beyond that point (i_size > remote_i_size), the 'zero_point'—the offset from which the server is assumed to return only zeros—is incorrectly updated using the local i_size instead of the remote_i_size. This results in the kernel incorrectly assuming certain file regions contain zeros, leading to short reads or read-gaps. The issue was primarily observed on CIFS mounts with default caching enabled. Patches have been released for various stable kernel branches including 6.11 and 7.0.x.
Affected products
- Linux Linux 6.10.8, 6.11, 7.0.11
Timeline
- 2026-05-12: patched: Initial fix committed to Linux kernel source
- 2026-07-19: disclosed: CVE-2026-64159 published