CVE-2026-64059
Received Received - Intake

Memory Corruption in Linux Kernel netfs

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio->private handling in netfs_perform_write() Under some circumstances, netfs_perform_write() doesn't correctly manipulate folio->private between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing to a group and pointing to a netfs_folio struct, leading to potential multiple attachments of private data with associated folio ref leaks and also leaks of netfs_folio structs or netfs_group refs. Fix this by consolidating the place at which a folio is marked uptodate in one place and having that look at what's attached to folio->private and decide how to clean it up and then set the new group. Also, the content shouldn't be flushed if group is NULL, even if a group is specified in the netfs_group parameter, as that would be the case for a new folio. A filesystem should always specify netfs_group or never specify netfs_group. The Sashiko auto-review tool noted that it was theoretically possible that the fpos >= ctx->zero_point section might leak if it modified a streaming write folio. This is unlikely, but with a network filesystem, third party changes can happen. It also pointed out that __netfs_set_group() would leak if called multiple times on the same folio from the "whole folio modify section".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64059
EUVD
EUVD-2026-45632

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability affecting the netfs subsystem. It involves incorrect handling of folio->private in netfs_perform_write(), leading to potential multiple attachments of private data, folio reference leaks, and leaks of netfs_folio structs or netfs_group references.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfs subsystem and requires kernel-level detection. There are no standard commands to detect this issue directly. Monitoring kernel logs for filesystem-related errors or crashes may indicate exploitation. Check for kernel oops messages or filesystem errors in dmesg or journalctl logs.

Impact Analysis

The vulnerability could cause memory leaks and potential crashes in systems using network filesystems. It may also lead to data corruption or instability in affected filesystems due to improper management of folio private data.

Compliance Impact

This vulnerability affects Linux kernel filesystem operations but does not directly impact compliance with standards like GDPR or HIPAA. It involves potential data leaks through folio reference mishandling in network filesystems, which could indirectly affect data integrity or confidentiality if exploited.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patches are unavailable, consider disabling network filesystems temporarily or restricting access to them until updates are applied. Monitor kernel logs for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart