CVE-2026-64059: Linux Kernel Privilege Escalation Flaw

CVE-2026-64059 Overview

CVE-2026-64059 affects the Linux kernel's network filesystem (netfs) subsystem. The vulnerability resides in netfs_perform_write(), which fails to correctly manipulate folio->private between the states NULL, NETFS_FOLIO_COPY_TO_CACHE, a group pointer, and a netfs_folio struct pointer. This inconsistent state handling can lead to multiple attachments of private data, folio reference leaks, and leaks of netfs_folio structs or netfs_group references. The issue affects filesystems layered on the netfs helper library, which underpins network-based file access in modern Linux kernels. Upstream maintainers have committed a fix that consolidates where a folio is marked uptodate and reasons about existing folio->private state before assigning a new group.

Critical Impact
Repeated writes through affected code paths can exhaust kernel memory and folio references, degrading system stability on Linux hosts using netfs-backed filesystems.

Affected Products

Linux kernel netfs subsystem (mainline)
Linux stable kernel branches referenced by the upstream fix commits
Network filesystems built on top of the netfs helper library

Discovery Timeline

2026-07-19 - CVE-2026-64059 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64059

Vulnerability Analysis

The defect lies in netfs_perform_write(), the buffered write helper used by netfs-based filesystems. The function tracks per-folio state through folio->private, which can validly hold one of several values: NULL, the sentinel NETFS_FOLIO_COPY_TO_CACHE, a pointer to a netfs_group, or a pointer to a netfs_folio struct. Under certain code paths, the function overwrites folio->private without releasing the prior value. This produces reference count leaks on the underlying folio, and it strands netfs_folio structures and netfs_group references that were previously attached.

The Sashiko auto-review tool identified two additional leak paths. The fpos >= ctx->zero_point branch can leak when it modifies a streaming write folio, which is plausible with a network filesystem where third-party changes occur. The __netfs_set_group() helper also leaks when invoked multiple times on the same folio inside the whole-folio modify section.

Root Cause

The root cause is inconsistent state management for folio->private. Multiple code paths marked a folio uptodate and assigned new private data without a single authoritative site that inspected the existing value and released it. The fix consolidates the uptodate transition into one location, examines what is attached, cleans it up, and then sets the new group.

Attack Vector

This is a local kernel memory management defect rather than a remotely triggerable vulnerability. It manifests through normal buffered write workloads on netfs-backed filesystems, and behavior may be amplified when a remote server modifies files concurrently. No proof-of-concept exploit is published, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. See the upstream commits linked in the references section for the precise code changes: Kernel Git Commit 0969ea8, Kernel Git Commit 551b5c7, Kernel Git Commit 7f04024, and Kernel Git Commit ccde2ac.

Detection Methods for CVE-2026-64059

Indicators of Compromise

Gradual increase in kernel slab allocations attributable to netfs_folio or netfs_group objects over time.
Rising folio reference counts on files served by network filesystems that use the netfs helper library.
kmemleak reports referencing netfs_perform_write or __netfs_set_group call sites.

Detection Strategies

Compare the running kernel version and netfs subsystem commit hashes against the upstream fix commits linked in this advisory.
Enable CONFIG_DEBUG_KMEMLEAK on test systems and exercise heavy buffered write workloads on netfs-backed mounts to surface accumulating allocations.
Track slab statistics via /proc/slabinfo for netfs-related caches during sustained write activity.

Monitoring Recommendations

Monitor kernel memory pressure and slab growth on Linux hosts using AFS, Ceph, 9P, CIFS/SMB, or NFS over netfs.
Alert on unexpected dmesg entries referencing netfs, folio reference imbalances, or memory leak detector warnings.
Track kernel package versions across the fleet and flag hosts that lag the patched stable release.

How to Mitigate CVE-2026-64059

Immediate Actions Required

Apply the stable kernel update that contains the upstream fix commits for netfs_perform_write() folio handling.
Reboot affected hosts to activate the patched kernel, since the netfs subsystem is compiled into the kernel image on most distributions.
Inventory systems running netfs-backed network filesystems and prioritize patching hosts with sustained write workloads.

Patch Information

The fix is available in the upstream Linux kernel via commits 0969ea8, 551b5c7, 7f04024, and ccde2ac. Consume the fix through your distribution's stable kernel update channel once the vendor backports it to the supported branches.

Workarounds

Reduce exposure by limiting heavy buffered write workloads on netfs-backed mounts until the kernel is patched.
Where feasible, mount affected shares with alternative access paths that do not exercise netfs_perform_write().
Reboot long-running hosts periodically to reclaim leaked kernel memory as an operational stopgap until patching completes.

bash

# Verify running kernel and check for the netfs fix commits
uname -r
# On Debian/Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# On RHEL/Fedora
rpm -qa | grep kernel
# Apply distribution kernel updates and reboot
# Debian/Ubuntu:
#   sudo apt update && sudo apt upgrade && sudo reboot
# RHEL/Fedora:
#   sudo dnf update kernel && sudo reboot