Executive brief
The Linux kernel's NFS subsystem incorrectly charged write-back accounting by entire folio size per request, rather than by the actual bytes each request covers. When a large folio is split into many smaller requests (e.g., with pNFS striping or write-size limits), accounting was inflated by orders of magnitude—a 2 MiB folio split into 512 requests could inflate accounting by 512x. This caused the kernel to incorrectly throttle all buffered writers system-wide, degrading I/O performance even for unrelated NFS server threads.
Technical details
This is an accounting logic error in the NFS subsystem's folio-based write-back handling. The functions nfs_folio_mark_unstable() and nfs_folio_clear_commit() charged global NR_WRITEBACK and WB_WRITEBACK counters using the full folio page count once per *request*, rather than once per folio. When the NFS layer splits a folio into multiple requests via pg_test (e.g., pNFS flexfiles with stripe units smaller than folio size, or wsize-limited splitting), each request independently charged the entire folio's size, multiplying the accounting error. The fix changes the charge calculation from folio_nr_pages(folio) to DIV_ROUND_UP(req->wb_bytes, PAGE_SIZE), charging only for the request's actual byte range. This is not a security vulnerability but a resource accounting bug that degrades system performance.
Affected products
- Linux Linux kernel multiple versions before patch (0c493b5cf16e introduced regression in folio conversion)
Timeline
- 2026-07-07: disclosed: Patch authored
- 2026-07-24: patched: Patch committed to stable trees