{"api_version":"1","generated_at":"2026-07-22T13:17:43+00:00","cve":"CVE-2026-64064","urls":{"html":"https://cve.report/CVE-2026-64064","api":"https://cve.report/api/cve/CVE-2026-64064.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-64064","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64064"},"summary":{"title":"netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone\n\nIf a streaming write is made, this will leave the relevant modified folio\nin a not-uptodate, but dirty state with a netfs_folio struct hung off of\nfolio->private indicating the dirty range.  Subsequently truncating the\nfile such that the dirty data in the folio is removed, but the first part\nof the folio theoretically remains will cause the netfs_folio struct to be\ndiscarded... but will leave the dirty flag set.\n\nIf the folio is then read via mmap(), netfs_read_folio() will see that the\npage is dirty and jump to netfs_read_gaps() to fill in the missing bits.\nnetfs_read_gaps(), however, expects there to be a netfs_folio struct\npresent and can oops because truncate removed it.\n\nFix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the\nevent that all the dirty data in the folio is erased (as nfs does).\n\nAlso add some tracepoints to log modifications to a dirty page.\n\nThis can be reproduced with something like:\n\n    dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1\n    umount /xfstest.test\n    mount /xfstest.test\n    xfs_io -c \"w 0xbbbf 0xf96c\" \\\n           -c \"truncate 0xbbbf\" \\\n           -c \"mmap -r 0xb000 0x11000\" \\\n           -c \"mr 0xb000 0x11000\" \\\n           /xfstest.test/foo\n\nwith fscaching disabled (otherwise streaming writes are suppressed) and a\nchange to netfs_perform_write() to disallow streaming writes if the fd is\nopen O_RDWR:\n\n\tif (//(file->f_mode & FMODE_READ) || <--- comment this out\n\t    netfs_is_cache_enabled(ctx)) {\n\nIt should be reproducible even without this change, but if prevents the\nabove trivial xfs_io command from reproducing it.\n\nNote that the initial dd is important: the file must start out sufficiently\nlarge that the zero-point logic doesn't just clear the gaps because it\nknows there's nothing in the file to read yet.  Unmounting and mounting is\nneeded to clear the pagecache (there are other ways to do that that may\nalso work).\n\nThis was initially reproduced with the generic/522 xfstest on some patches\nthat remove the FMODE_READ restriction.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 16:17:46","updated_at":"2026-07-19 16:17:46"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/fb6ec883b48b8789e5e690dcd440d2db941e840c","name":"https://git.kernel.org/stable/c/fb6ec883b48b8789e5e690dcd440d2db941e840c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/65ae8717abf36202fef02260b64b781d2d44a9bf","name":"https://git.kernel.org/stable/c/65ae8717abf36202fef02260b64b781d2d44a9bf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/156ac2ec2ee77c44c4eb7439d6d165247ba12247","name":"https://git.kernel.org/stable/c/156ac2ec2ee77c44c4eb7439d6d165247ba12247","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/31ba145faceb378fa01afcb8349e15ea7d95e542","name":"https://git.kernel.org/stable/c/31ba145faceb378fa01afcb8349e15ea7d95e542","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64064","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64064","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ebff83e648148b9ece97d4e4890dd84ca54d6ce 31ba145faceb378fa01afcb8349e15ea7d95e542 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ebff83e648148b9ece97d4e4890dd84ca54d6ce fb6ec883b48b8789e5e690dcd440d2db941e840c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ebff83e648148b9ece97d4e4890dd84ca54d6ce 65ae8717abf36202fef02260b64b781d2d44a9bf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ebff83e648148b9ece97d4e4890dd84ca54d6ce 156ac2ec2ee77c44c4eb7439d6d165247ba12247 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.92 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.34 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.11 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"64064","cve":"CVE-2026-64064","epss":"0.001680000","percentile":"0.063850000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/misc.c","include/trace/events/netfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"31ba145faceb378fa01afcb8349e15ea7d95e542","status":"affected","version":"9ebff83e648148b9ece97d4e4890dd84ca54d6ce","versionType":"git"},{"lessThan":"fb6ec883b48b8789e5e690dcd440d2db941e840c","status":"affected","version":"9ebff83e648148b9ece97d4e4890dd84ca54d6ce","versionType":"git"},{"lessThan":"65ae8717abf36202fef02260b64b781d2d44a9bf","status":"affected","version":"9ebff83e648148b9ece97d4e4890dd84ca54d6ce","versionType":"git"},{"lessThan":"156ac2ec2ee77c44c4eb7439d6d165247ba12247","status":"affected","version":"9ebff83e648148b9ece97d4e4890dd84ca54d6ce","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/netfs/misc.c","include/trace/events/netfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.92","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.34","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.11","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"6.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone\n\nIf a streaming write is made, this will leave the relevant modified folio\nin a not-uptodate, but dirty state with a netfs_folio struct hung off of\nfolio->private indicating the dirty range.  Subsequently truncating the\nfile such that the dirty data in the folio is removed, but the first part\nof the folio theoretically remains will cause the netfs_folio struct to be\ndiscarded... but will leave the dirty flag set.\n\nIf the folio is then read via mmap(), netfs_read_folio() will see that the\npage is dirty and jump to netfs_read_gaps() to fill in the missing bits.\nnetfs_read_gaps(), however, expects there to be a netfs_folio struct\npresent and can oops because truncate removed it.\n\nFix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the\nevent that all the dirty data in the folio is erased (as nfs does).\n\nAlso add some tracepoints to log modifications to a dirty page.\n\nThis can be reproduced with something like:\n\n    dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1\n    umount /xfstest.test\n    mount /xfstest.test\n    xfs_io -c \"w 0xbbbf 0xf96c\" \\\n           -c \"truncate 0xbbbf\" \\\n           -c \"mmap -r 0xb000 0x11000\" \\\n           -c \"mr 0xb000 0x11000\" \\\n           /xfstest.test/foo\n\nwith fscaching disabled (otherwise streaming writes are suppressed) and a\nchange to netfs_perform_write() to disallow streaming writes if the fd is\nopen O_RDWR:\n\n\tif (//(file->f_mode & FMODE_READ) || <--- comment this out\n\t    netfs_is_cache_enabled(ctx)) {\n\nIt should be reproducible even without this change, but if prevents the\nabove trivial xfs_io command from reproducing it.\n\nNote that the initial dd is important: the file must start out sufficiently\nlarge that the zero-point logic doesn't just clear the gaps because it\nknows there's nothing in the file to read yet.  Unmounting and mounting is\nneeded to clear the pagecache (there are other ways to do that that may\nalso work).\n\nThis was initially reproduced with the generic/522 xfstest on some patches\nthat remove the FMODE_READ restriction."}],"providerMetadata":{"dateUpdated":"2026-07-19T15:39:42.770Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/31ba145faceb378fa01afcb8349e15ea7d95e542"},{"url":"https://git.kernel.org/stable/c/fb6ec883b48b8789e5e690dcd440d2db941e840c"},{"url":"https://git.kernel.org/stable/c/65ae8717abf36202fef02260b64b781d2d44a9bf"},{"url":"https://git.kernel.org/stable/c/156ac2ec2ee77c44c4eb7439d6d165247ba12247"}],"title":"netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-64064","datePublished":"2026-07-19T15:39:42.770Z","dateReserved":"2026-07-19T07:54:57.030Z","dateUpdated":"2026-07-19T15:39:42.770Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 16:17:46","lastModifiedDate":"2026-07-19 16:17:46","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"64064","Ordinal":"1","Title":"netfs: Fix netfs_invalidate_folio() to clear dirty bit if all ch","CVE":"CVE-2026-64064","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"64064","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone\n\nIf a streaming write is made, this will leave the relevant modified folio\nin a not-uptodate, but dirty state with a netfs_folio struct hung off of\nfolio->private indicating the dirty range.  Subsequently truncating the\nfile such that the dirty data in the folio is removed, but the first part\nof the folio theoretically remains will cause the netfs_folio struct to be\ndiscarded... but will leave the dirty flag set.\n\nIf the folio is then read via mmap(), netfs_read_folio() will see that the\npage is dirty and jump to netfs_read_gaps() to fill in the missing bits.\nnetfs_read_gaps(), however, expects there to be a netfs_folio struct\npresent and can oops because truncate removed it.\n\nFix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the\nevent that all the dirty data in the folio is erased (as nfs does).\n\nAlso add some tracepoints to log modifications to a dirty page.\n\nThis can be reproduced with something like:\n\n    dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1\n    umount /xfstest.test\n    mount /xfstest.test\n    xfs_io -c \"w 0xbbbf 0xf96c\" \\\n           -c \"truncate 0xbbbf\" \\\n           -c \"mmap -r 0xb000 0x11000\" \\\n           -c \"mr 0xb000 0x11000\" \\\n           /xfstest.test/foo\n\nwith fscaching disabled (otherwise streaming writes are suppressed) and a\nchange to netfs_perform_write() to disallow streaming writes if the fd is\nopen O_RDWR:\n\n\tif (//(file->f_mode & FMODE_READ) || <--- comment this out\n\t    netfs_is_cache_enabled(ctx)) {\n\nIt should be reproducible even without this change, but if prevents the\nabove trivial xfs_io command from reproducing it.\n\nNote that the initial dd is important: the file must start out sufficiently\nlarge that the zero-point logic doesn't just clear the gaps because it\nknows there's nothing in the file to read yet.  Unmounting and mounting is\nneeded to clear the pagecache (there are other ways to do that that may\nalso work).\n\nThis was initially reproduced with the generic/522 xfstest on some patches\nthat remove the FMODE_READ restriction.","Type":"Description","Title":"netfs: Fix netfs_invalidate_folio() to clear dirty bit if all ch"}]}}}