Junglewise Threat Intelligence

CVE-2026-80898: Linux kernel netfs PG_private_2 state leak on cache append failure

CVE-2026-80898 · Severity: info · Published 2026-09-04

Executive brief

The Linux kernel's network filesystem (netfs) cache layer can leak memory page state metadata when a copy-to-cache operation fails to append to the rolling buffer. This causes cached pages to remain marked as in-progress indefinitely, preventing proper cleanup and potentially degrading system cache performance over time.

Technical details

The vulnerability is a resource leak in the netfs layer's copy-to-cache path. The function netfs_pgpriv2_copy_to_cache() marks a folio (kernel page) with the PG_private_2 flag before attempting to append it to a rolling buffer via netfs_pgpriv2_copy_folio(). If the rolling_buffer_append() call fails (returns < 0), the code path fails to release the PG_private_2 state and its associated reference, leaving the page in an inconsistent state. The fix adds a folio_end_private_2() call in the error path to properly clean up the page flag. This is a local impact issue affecting kernel memory management; no network vector or user authentication requirement exists.

Affected products

  • Linux Linux kernel 5.0 and later (netfs subsystem)

Timeline

  • 2026-09-04: disclosed: Published as CVE-2026-80898

References

Related threats