CVE-2026-64058: Linux Kernel Privilege Escalation Flaw

CVE-2026-64058 Overview

CVE-2026-64058 is a race condition vulnerability in the Linux kernel's network filesystem (netfs) subsystem. The flaw exists in the netfs_read_folio() function, which fails to wait for an ongoing writeback operation to complete before proceeding. This creates a time-of-check to time-of-use (TOCTOU) condition where the dirty flag and folio->private data cannot be trusted. The collector may clean up folio->private before clearing the writeback flag, leading to memory corruption or use-after-free conditions when the read path accesses stale metadata.

Critical Impact
A local authenticated attacker can exploit this race condition in the netfs subsystem to compromise confidentiality, integrity, and availability of the affected Linux system.

Affected Products

Linux kernel versions containing the vulnerable netfs_read_folio() implementation
Linux distributions built on affected upstream kernel versions
Systems using network filesystems that rely on the netfs helper library

Discovery Timeline

2026-07-19 - CVE-2026-64058 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64058

Vulnerability Analysis

The vulnerability resides in the Linux kernel's netfs library, which provides shared infrastructure for network filesystem clients. The netfs_read_folio() function is responsible for reading a folio (a page or group of pages) from a network filesystem into memory. The function reads folio state, including the dirty flag and the folio->private pointer, without first synchronizing with any concurrent writeback operation.

When a writeback operation is in progress, a separate collector routine tears down the write context attached to folio->private. This teardown can occur before the writeback flag on the folio is cleared. If netfs_read_folio() executes during this window, it reads a folio marked as under writeback with folio->private already freed or partially cleaned. The function then dereferences stale metadata, resulting in undefined behavior.

Root Cause

The root cause is missing synchronization between the read path and the writeback completion path. The read path trusts the dirty flag and folio->private contents without calling a folio-wait primitive to block until writeback completes. Because the collector clears folio->private before the writeback bit, any observer that samples state between those two events sees an inconsistent folio.

Attack Vector

Exploitation requires local access with low privileges. An attacker triggers concurrent read and write operations against a network filesystem mount that uses the netfs helpers. By racing writeback completion against a folio read, the attacker induces the kernel to dereference freed memory attached to folio->private. Successful exploitation can corrupt kernel memory, leak sensitive data across folios, or crash the kernel. Refer to the Linux Kernel Commit B8271CC, Linux Kernel Commit DED0C6F, and Linux Kernel Commit F17B912 for the fix that adds the writeback wait.

Detection Methods for CVE-2026-64058

Indicators of Compromise

Unexpected kernel oops or panic messages referencing netfs_read_folio, folio->private, or writeback state in dmesg output
KASAN (Kernel Address Sanitizer) reports of use-after-free in the netfs subsystem on kernels built with sanitizer support
Filesystem I/O anomalies on network filesystem mounts, including corrupted reads or stalled processes

Detection Strategies

Monitor kernel logs for stack traces originating in fs/netfs/ and containing writeback or folio-related symbols
Audit installed kernel versions against upstream stable trees and identify hosts still running the pre-patch commits
Track abnormal process termination on hosts mounting CIFS, NFS, Ceph, or other netfs-based filesystems

Monitoring Recommendations

Collect and centralize kernel ring buffer output through syslog or journald forwarding to a SIEM for correlation
Enable kdump to capture crash dumps for post-incident analysis of suspected netfs race exploitation
Establish baselines for network filesystem I/O behavior and alert on deviations that coincide with kernel warnings

How to Mitigate CVE-2026-64058

Immediate Actions Required

Inventory all Linux hosts running kernels that include the vulnerable netfs_read_folio() implementation
Apply the upstream stable kernel patches referenced in the commits b8271cc, ded0c6f, and f17b912 as soon as distribution updates are available
Restrict local shell access on multi-tenant systems that mount network filesystems until patched

Patch Information

The fix modifies netfs_read_folio() to wait for any in-progress writeback to complete before evaluating the dirty flag or dereferencing folio->private. The patches are available in the mainline and stable Linux kernel trees. Deploy the kernel update from your distribution vendor and reboot affected hosts to activate the fix.

Workarounds

Reduce concurrent read and write workloads against netfs-backed mounts until the patched kernel is deployed
Limit local user access on systems exposing network filesystem mounts to trusted principals only
Consider mounting affected filesystems read-only where write access is not operationally required

bash

# Verify running kernel version and check for the fix
uname -r

# Debian and Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r)
sudo reboot

# Red Hat, CentOS, Fedora
sudo dnf update kernel
sudo reboot

# Confirm the netfs commits are present in the source of a custom build
git log --oneline | grep -E 'b8271cc|ded0c6f|f17b912'