CVE-2026-64062 Overview
CVE-2026-64062 is a Linux kernel vulnerability in the network filesystem (netfs) subsystem. The flaw exists in the netfs_advance_writethrough() function, which fails to consistently unlock the supplied folio and mark it dirty when write-through mode has not completed writing to the end. Under specific conditions involving memory-mapped reads and writes, the incorrect folio state handling can trigger a deadlock in the kernel. The vulnerability affects Linux kernel versions containing the netfs write-through implementation and has been patched across multiple stable branches.
Critical Impact
A local attacker or workload issuing concurrent mmap-based reads and writes against a netfs-backed filesystem can trigger a kernel deadlock, resulting in denial of service.
Affected Products
- Linux kernel — netfs subsystem (netfs_advance_writethrough())
- Network filesystem clients relying on netfs write-through mode
- Distributions shipping affected stable kernel branches prior to the fix commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64062 published to the National Vulnerability Database (NVD)
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64062
Vulnerability Analysis
The vulnerability resides in the Linux kernel netfs write-through path. The function netfs_advance_writethrough() did not always unlock the supplied folio or mark it dirty when the write operation had not reached the end of the folio. When mmapped readers and writers race against a write-through operation, the inconsistent folio state can cause threads to wait on each other indefinitely.
The fix ensures the folio is always unlocked and marked dirty when it is not yet fully written. The folio cannot be immediately marked for writeback, because doing so would reintroduce the deadlock against mmapped reads and writes. Marking the folio dirty alone is safe, because the caller holds inode->i_rwsem — which blocks concurrent truncation, fallocate, direct I/O, and other writes — as well as ictx->wb_lock, which forces flushers to wait or skip. This locking discipline prevents premature writeback from occurring while the write-through path completes.
Root Cause
The root cause is a race condition [CWE-667 Improper Locking] in the netfs write-through flow. The prior implementation left folios in an inconsistent locked or clean state on certain code paths, allowing threads holding related filesystem or memory management locks to block indefinitely.
Attack Vector
Exploitation requires local access with the ability to perform mmap-based reads and writes against a file backed by a netfs-using filesystem. No memory corruption or privilege escalation primitive is described in the upstream fix. The observable impact is a denial-of-service condition affecting the filesystem workload and, potentially, kernel threads waiting on the deadlocked locks.
No verified public exploit code is available. Technical details are documented in the upstream fix commits: Kernel Git Commit 003aa0d, Kernel Git Commit 1468f39, Kernel Git Commit b6a4ae1, and Kernel Git Commit e40e9cb.
Detection Methods for CVE-2026-64062
Indicators of Compromise
- Kernel hung task messages naming netfs functions such as netfs_advance_writethrough, netfs_writepages, or folio_wait_* in dmesg or /var/log/kern.log.
- Processes stuck in uninterruptible sleep (D state) while performing I/O against network filesystems that use the netfs library.
- Sustained lock contention on inode->i_rwsem or netfs wb_lock visible in /proc/<pid>/stack traces.
Detection Strategies
- Compare running kernel versions against distribution advisories referencing the netfs write-through fix commits listed above.
- Enable kernel.hung_task_timeout_secs and monitor kernel logs for repeated hung task reports involving netfs symbols.
- Track filesystem workload latency baselines to identify sudden stalls on netfs-backed mounts.
Monitoring Recommendations
- Collect kernel logs centrally and alert on hung_task and INFO: task ... blocked events referencing netfs.
- Instrument mmap-heavy workloads on network filesystems with I/O latency and stall counters.
- Track kernel package versions across the fleet to confirm patched builds are deployed after vendor updates.
How to Mitigate CVE-2026-64062
Immediate Actions Required
- Inventory hosts running kernels that include the netfs write-through path and are not yet patched to the fix commits.
- Apply vendor-supplied kernel updates that incorporate the upstream netfs fix, then reboot to activate the new kernel.
- Prioritize systems that host workloads combining mmap I/O with network filesystems.
Patch Information
The fix is applied across multiple stable branches in the upstream Linux kernel. Reference the fix commits directly: Kernel Git Commit 003aa0d, Kernel Git Commit 1468f39, Kernel Git Commit b6a4ae1, and Kernel Git Commit e40e9cb. Deploy the kernel package supplied by your distribution once it includes these changes.
Workarounds
- Avoid workloads that mix mmap-based reads and writes against network filesystems using the netfs write-through path until patched kernels are deployed.
- Where feasible, use direct I/O or buffered I/O without shared writable mmap on affected mounts to reduce exposure.
- Restrict local access on multi-tenant systems to limit the population of users able to trigger the race.
# Verify the running kernel and pending updates
uname -r
# Debian/Ubuntu
apt list --upgradable 2>/dev/null | grep -E '^linux-(image|generic)'
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/-generic//')-generic
# RHEL/CentOS/Rocky/Alma
sudo dnf check-update kernel
sudo dnf update kernel
# Reboot to activate the patched kernel
sudo systemctl reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
