CVE-2026-64063: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64063 Overview

CVE-2026-64063 is a Linux kernel vulnerability in the network filesystem (netfs) library. The flaw affects the streaming write logic in netfs_perform_write(), where partially written folios can be incorrectly handled during overwrite operations. Netfslib supports streaming writes that store dirty data directly into folios without reading them first, marking them dirty via an attached netfs_folio structure. When a partially written streaming write page is entirely overwritten by a subsequent write, the code fails to discard the netfs_folio structure and mishandles partial copies that overlap with existing dirty regions. The issue was reproduced on cifs mounts using fsx fuzzing operations and initially surfaced via the generic/522 xfstest.

Critical Impact
Data integrity corruption in network filesystem writes when streaming write folios are overwritten, potentially leading to inconsistent file contents on affected mounts.

Affected Products

Linux kernel netfs subsystem (affected stable branches per kernel.org commits)
Filesystems using netfslib, including cifs with default cache option
Systems running affected Linux kernel versions prior to the referenced patch commits

Discovery Timeline

2026-07-19 - CVE-2026-64063 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64063

Vulnerability Analysis

The vulnerability resides in the netfs_perform_write() function within the Linux kernel's netfs library. Netfslib implements streaming writes to avoid read-before-write penalties on network filesystems. Dirty data lands directly into folios, and a netfs_folio structure attached to ->private records the dirty region when the folio is not fully written. If a streaming write completely fills a folio, the folio is marked uptodate; otherwise, the netfs_folio metadata tracks partial state.

The defect appears when a partially written folio receives a subsequent write() intended to overwrite it entirely. The existing logic attempts the copy but does not discard the stale netfs_folio structure on success. It also fails to correctly reconcile partial copies that overlap only some of the previously recorded dirty bytes. This leads to inconsistent metadata between the folio contents and the tracked dirty region.

Root Cause

The root cause is incorrect state management of the netfs_folio private structure during overwrite operations. The write path did not free the metadata after a successful full overwrite and did not update the dirty region bounds after a partial overwrite. This constitutes a state confusion defect in the streaming write accounting logic.

Attack Vector

The issue is reachable through normal filesystem write operations on netfs-backed mounts such as cifs when the default cache option is used and fscache is disabled. Reproduction requires a specific sequence of overlapping writes, truncations, and copy_range operations against a single folio. The reproducer uses fsx with a scripted operation file (junk.fsxops) performing truncate, write, copy_range, and read operations at crafted offsets. There is no evidence of a known remote code execution primitive; the observable effect is data corruption on the mounted filesystem.

The fix implements three corrections: freeing the netfs_folio structure when a folio is successfully overwritten before marking it uptodate, ignoring copies that partially fail without touching dirty data, and updating the netfs_folio structure to record new bounds when a partial copy overwrites part of the dirty region.

Detection Methods for CVE-2026-64063

Indicators of Compromise

Unexpected data mismatches on cifs or other netfs-backed mounts after concurrent or overlapping write workloads
generic/522 xfstest failures on affected kernels using cifs with default cache options
fsx reporting content divergence between expected and observed file state during long-running I/O tests

Detection Strategies

Compare running kernel version against the fixed commits 20195925, 7b4dcf1b, cdae00e8, and ef9b5212 on git.kernel.org
Run filesystem integrity tests such as fsx and the xfstests generic/522 case against network mounts to identify unpatched hosts
Audit /proc/version and package inventory across Linux fleet for kernels lacking the netfs streaming write fix

Monitoring Recommendations

Monitor kernel logs for netfs subsystem warnings or unexpected folio state assertions during heavy cifs I/O
Track file checksum drift on shared network filesystems where cifs is used as the client
Alert on repeated xfstests or CI pipeline failures involving cifs mounts, which may indicate exposure to this defect

How to Mitigate CVE-2026-64063

Immediate Actions Required

Identify Linux hosts running kernels with the netfs subsystem enabled and using cifs or other netfs-backed filesystems
Apply the upstream kernel patches referenced by commits 20195925c768, 7b4dcf1b9455, cdae00e8e215, and ef9b521212e4
Schedule kernel updates via your distribution vendor as backports become available for supported stable branches

Patch Information

The fix is available through four upstream Linux kernel commits published on git.kernel.org: Kernel Patch Commit 20195925, Kernel Patch Commit 7b4dcf1b, Kernel Patch Commit cdae00e8, and Kernel Patch Commit ef9b5212. The patch modifies netfs_perform_write() to correctly free the netfs_folio structure on full overwrite and update dirty region bounds on partial overwrite.

Workarounds

Where feasible, enable fscache for cifs mounts, which alters the code path guarded by the FMODE_READ and netfs_is_cache_enabled(ctx) check and avoids the defective streaming write branch
Avoid workloads that perform overlapping partial writes to the same folio on affected netfs mounts until the kernel is patched
Use alternative mount options that force read-before-write behavior where the deployment allows it

bash

# Verify running kernel and check for the netfs fix commit in changelog
uname -r
rpm -q --changelog kernel | grep -E '20195925|7b4dcf1b|cdae00e8|ef9b5212'
# Debian/Ubuntu equivalent
dpkg -l | grep linux-image
zcat /usr/share/doc/linux-image-$(uname -r)/changelog.Debian.gz | grep -E 'netfs.*streaming'