Executive brief
The Linux kernel's exFAT filesystem implementation contains a race condition in how it handles file size extension when multiple processes access the same file through memory mapping. A concurrent store operation can race with the kernel's gap-zeroing logic and have its data overwritten, potentially causing data loss or corruption on exFAT-formatted storage devices used in embedded systems, portable media, or older operating system support.
Technical details
The vulnerability is a race condition (CWE-362) in the exfat filesystem's valid_size extension mechanism. When a shared writable memory mapping has its valid_size extended via buffered write or page fault, the kernel zeros the page-cache gap below the new valid_size. However, a concurrent store through the mapping can race with this zeroing and be overwritten. The fix changes the gap-zeroing from eager (inline) to lazy (deferred), drops the ->map_pages optimization to force all write faults through exfat_page_mkwrite(), and implements block-granularity gap filling that preserves existing uptodate blocks. The vulnerability affects buffered I/O operations on exFAT filesystems; no network attack vector exists, but local privilege escalation is not required—any process with file write access can trigger it. The patch has been committed upstream (commit 1135704ed22f54873eb0498a232611d9eca30dd4) and backported to stable branches.
Affected products
- Linux Linux Kernel Affected versions prior to commit 1135704ed22f54873eb0498a232611d9eca30dd4 (introduced in commit 82a81a7352bc)
Timeline
- 2026-09-17: disclosed: CVE published on NVD
- 2026-07-22: patched: Upstream patch committed (1135704ed22f54873eb0498a232611d9eca30dd4)
- 2026-09-14: patched: Backported to stable kernel branches