CVE-2026-64160

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel Netfslib

Publication date: 2026-07-19

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-17

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64160

EUVD

EUVD-2026-45845

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.18 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves potential data tearing in the remote_i_size and zero_point fields. It occurs when these fields are updated without proper synchronization, specifically when i_size_seqcount gets corrupted due to missing i_lock protection during size updates.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfs subsystem and involves potential data tearing in size-related fields. Detection requires checking kernel logs for related errors or verifying if your kernel version includes the fix. Commands like dmesg | grep netfs or checking uname -r for kernel version may help identify affected systems.

Impact Analysis

This vulnerability could lead to data corruption or inconsistencies in filesystems using netfslib. If exploited, it may cause applications to read incorrect file sizes or zero-point values, potentially resulting in crashes, incorrect data processing, or security issues.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a kernel-level issue in the Linux filesystem handling. No evidence suggests data exposure or privacy violations that would impact regulatory compliance.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this issue. If immediate patching is not possible, ensure no custom netfs modules are modifying size fields without proper locking. Monitor kernel logs for signs of corruption in i_size_seqcount.

Hi! I’m here to help you understand CVE-2026-64160. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70