Junglewise Threat Intelligence

CVE-2026-72132: Linux kernel NFS writeback accounting overflow

CVE-2026-72132 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's NFS subsystem incorrectly charged write-back accounting by entire folio size per request, rather than by the actual bytes each request covers. When a large folio is split into many smaller requests (e.g., with pNFS striping or write-size limits), accounting was inflated by orders of magnitude—a 2 MiB folio split into 512 requests could inflate accounting by 512x. This caused the kernel to incorrectly throttle all buffered writers system-wide, degrading I/O performance even for unrelated NFS server threads.

Technical details

This is an accounting logic error in the NFS subsystem's folio-based write-back handling. The functions nfs_folio_mark_unstable() and nfs_folio_clear_commit() charged global NR_WRITEBACK and WB_WRITEBACK counters using the full folio page count once per *request*, rather than once per folio. When the NFS layer splits a folio into multiple requests via pg_test (e.g., pNFS flexfiles with stripe units smaller than folio size, or wsize-limited splitting), each request independently charged the entire folio's size, multiplying the accounting error. The fix changes the charge calculation from folio_nr_pages(folio) to DIV_ROUND_UP(req->wb_bytes, PAGE_SIZE), charging only for the request's actual byte range. This is not a security vulnerability but a resource accounting bug that degrades system performance.

Affected products

  • Linux Linux kernel multiple versions before patch (0c493b5cf16e introduced regression in folio conversion)

Timeline

  • 2026-07-07: disclosed: Patch authored
  • 2026-07-24: patched: Patch committed to stable trees

References

Related threats