NFS: Charge unstable writes by request size, not folio size

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72132
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:21:30 UTC
Updated2026-08-15 06:21:30 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge and uncharge NR_WRITEBACK/WB_WRITEBACK by folio_nr_pages(folio) once per *request* added to or removed from a commit list. This is correct only when a folio has a single associated request. When pg_test splits a folio into N sub-folio requests (e.g. pNFS flexfiles striping with a stripe unit smaller than the folio size, or plain wsize-limited splitting), each of the N requests independently charges the whole folio's page count, inflating the accounting by a factor of N per folio. With large folios and small stripe units this reaches multiple orders of magnitude: a 2 MiB folio split into 512 4 KiB requests can charge up to 512x its real size, pushing global dirty+writeback accounting past the system's dirty threshold and forcing every buffered writer on the host into the hard-throttle path, including unrelated in-kernel NFS server threads sharing the box. Charge each request only for the pages it actually covers.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 0c493b5cf16e28d761b6e77c7c32aa0e7af70813 a442c258320b689f13d2205eaeeddf8b0e630288 git Not specified
CNA Linux Linux affected 0c493b5cf16e28d761b6e77c7c32aa0e7af70813 1f646e23372f3444dc5f0bcb5404a49d26756add git Not specified
CNA Linux Linux affected 0c493b5cf16e28d761b6e77c7c32aa0e7af70813 0ffc032294a29601b1019dba91aa1a930d90df17 git Not specified
CNA Linux Linux affected 0c493b5cf16e28d761b6e77c7c32aa0e7af70813 a192b6c149c6ea10cc88869accb78165eb454456 git Not specified
CNA Linux Linux affected 0c493b5cf16e28d761b6e77c7c32aa0e7af70813 27934d02cbeb8a957dd11c985a579e58d30c5270 git Not specified
CNA Linux Linux affected 6.3 Not specified
CNA Linux Linux unaffected 6.3 semver Not specified
CNA Linux Linux unaffected 6.6.148 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/27934d02cbeb8a957dd11c985a579e58d30c5270 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0ffc032294a29601b1019dba91aa1a930d90df17 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a192b6c149c6ea10cc88869accb78165eb454456 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a442c258320b689f13d2205eaeeddf8b0e630288 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1f646e23372f3444dc5f0bcb5404a49d26756add 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report