Executive brief
The Linux kernel's network filesystem (netfs) cache layer can leak memory page state metadata when a copy-to-cache operation fails to append to the rolling buffer. This causes cached pages to remain marked as in-progress indefinitely, preventing proper cleanup and potentially degrading system cache performance over time.
Technical details
The vulnerability is a resource leak in the netfs layer's copy-to-cache path. The function netfs_pgpriv2_copy_to_cache() marks a folio (kernel page) with the PG_private_2 flag before attempting to append it to a rolling buffer via netfs_pgpriv2_copy_folio(). If the rolling_buffer_append() call fails (returns < 0), the code path fails to release the PG_private_2 state and its associated reference, leaving the page in an inconsistent state. The fix adds a folio_end_private_2() call in the error path to properly clean up the page flag. This is a local impact issue affecting kernel memory management; no network vector or user authentication requirement exists.
Affected products
- Linux Linux kernel 5.0 and later (netfs subsystem)
Timeline
- 2026-09-04: disclosed: Published as CVE-2026-80898