Executive brief
The Linux kernel's netfs module contains a memory management bug where folio (page cache) references are not properly released when an error occurs during readahead buffer preparation. This can cause memory leaks that gradually degrade system performance and availability by consuming kernel memory that should be returned to the free pool.
Technical details
A resource leak vulnerability exists in the netfs_prepare_read_iterator() function in fs/netfs/buffered_read.c. The function batches readahead folios for release after I/O iterator preparation, but if rolling_buffer_load_from_ra() returns an error code after earlier folios have been added to the batch, the function returns immediately without calling folio_batch_release() on the accumulated batch. This leaves folio reference counts elevated and prevents proper cleanup. The fix adds a folio_batch_release() call before the error return to ensure batched references are released even on failure paths. No authentication or user interaction is required; this can be triggered through normal file readahead operations on affected kernel versions.
Affected products
- Linux Linux kernel Multiple versions (vulnerability introduced in commit 06fa229ceb36; fix available upstream and in stable branches)
Timeline
- 2026-09-04: disclosed: CVE-2026-80897 published
- 2026-07-27: patched: Fix committed upstream (commit 87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6)
- 2026-08-09: patched: Fix backported to stable kernel branches