CVE-2026-72132
Received Received - Intake

NFS Unstable Write Accounting Vulnerability in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge and uncharge NR_WRITEBACK/WB_WRITEBACK by folio_nr_pages(folio) once per *request* added to or removed from a commit list. This is correct only when a folio has a single associated request. When pg_test splits a folio into N sub-folio requests (e.g. pNFS flexfiles striping with a stripe unit smaller than the folio size, or plain wsize-limited splitting), each of the N requests independently charges the whole folio's page count, inflating the accounting by a factor of N per folio. With large folios and small stripe units this reaches multiple orders of magnitude: a 2 MiB folio split into 512 4 KiB requests can charge up to 512x its real size, pushing global dirty+writeback accounting past the system's dirty threshold and forcing every buffered writer on the host into the hard-throttle path, including unrelated in-kernel NFS server threads sharing the box. Charge each request only for the pages it actually covers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72132
EUVD
EUVD-2026-58890

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect accounting of unstable writes in the NFS (Network File System) subsystem. When a folio is split into multiple requests, the system charges the full folio size for each request instead of the actual pages covered by that request. This leads to inflated accounting, potentially causing the system to exceed its dirty threshold and forcing throttling of all buffered writers.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS implementation and does not have direct network or system detection commands. It requires kernel-level inspection to identify improper accounting of writeback pages. Monitor kernel logs for NFS-related errors or performance degradation during heavy write operations.

Impact Analysis

The vulnerability can severely degrade system performance by causing unnecessary throttling of write operations. This affects all buffered writers on the host, including unrelated NFS server threads, leading to slowdowns or hangs in file operations. Systems with large folios and small stripe units are particularly vulnerable.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, reduce NFS workloads or adjust NFS mount options to limit write sizes. Monitor system performance and dirty page thresholds to prevent throttling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72132. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart