CVE-2026-64064: Linux Kernel Privilege Escalation Flaw

CVE-2026-64064 is a privilege escalation vulnerability in the Linux kernel's netfs subsystem that can cause system crashes through improper handling of dirty page flags during file truncation operations. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-64064 Overview

CVE-2026-64064 is a Linux kernel vulnerability in the network filesystem (netfs) subsystem. The flaw resides in netfs_invalidate_folio(), which fails to clear the dirty bit when all dirty data in a folio is discarded through truncation. A subsequent mmap() read triggers netfs_read_folio(), which routes to netfs_read_gaps() expecting a netfs_folio struct that truncation already removed. The resulting NULL dereference produces a kernel oops.

Critical Impact
Local unprivileged users can trigger a kernel oops through a specific sequence of streaming writes, truncation, and memory-mapped reads on netfs-backed filesystems, leading to denial of service.

Affected Products

Linux kernel netfs subsystem (network filesystem helpers)
Filesystems relying on netfs helpers when fscaching is disabled
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64064 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64064

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the Linux kernel netfs subsystem. A streaming write leaves a modified folio in a not-uptodate but dirty state, with a netfs_folio struct attached via folio->private describing the dirty range. When the file is truncated so that the dirty portion of the folio is removed but part of the folio still logically exists, the kernel discards the netfs_folio struct without clearing the folio's dirty flag.

A later read through mmap() invokes netfs_read_folio(). Because the folio still appears dirty, control transfers to netfs_read_gaps() to reconstruct the missing regions. That function assumes a valid netfs_folio struct on folio->private, but truncation already freed it. Dereferencing the missing metadata crashes the kernel.

Root Cause

The root cause is a state-tracking inconsistency between netfs_invalidate_folio() and the folio dirty flag. When invalidation removes the last of the dirty range, the routine drops the netfs_folio bookkeeping structure but leaves PG_dirty asserted. The upstream fix calls folio_cancel_dirty() from netfs_invalidate_folio() when all dirty data has been erased, mirroring the behavior already used by NFS. Additional tracepoints were added to log modifications to a dirty page.

Attack Vector

Exploitation requires local filesystem access to a netfs-backed mount with fscaching disabled. The reproducer uses dd to allocate a file, an unmount/mount cycle to clear the page cache, and xfs_io to issue a streaming write, a truncation to the write offset, and an mmap read that spans the truncated region. The sequence forces the vulnerable path in netfs_read_gaps(), producing a kernel oops and denial of service on the affected host.

No verified public exploit code is available. The upstream commit message documents the reproduction methodology using xfs_io and the generic/522 xfstest.

Detection Methods for CVE-2026-64064

Indicators of Compromise

Kernel oops or panic messages referencing netfs_read_gaps, netfs_read_folio, or netfs_invalidate_folio in dmesg or /var/log/kern.log
Unexpected process termination on workloads issuing mmap() reads against recently truncated files on network filesystems
Crash signatures involving NULL pointer dereferences inside fs/netfs/ code paths

Detection Strategies

Monitor kernel ring buffers for oops traces containing netfs symbol names and correlate with the running kernel version against the fixed commits
Run the generic/522 xfstest against staging kernels to surface latent netfs folio state issues
Track kernel package inventory to identify hosts still running netfs code prior to commits 156ac2e, 31ba145, 65ae871, and fb6ec88

Monitoring Recommendations

Forward kernel.* syslog facilities to a central log platform and alert on BUG:, Oops:, and general protection fault events referencing netfs symbols
Track host availability metrics for network filesystem clients and correlate reboots with kernel crash telemetry
Enable the new netfs tracepoints introduced alongside the fix to record modifications to dirty pages during triage

How to Mitigate CVE-2026-64064

Immediate Actions Required

Update to a Linux kernel build that includes commits 156ac2e, 31ba145, 65ae871, and fb6ec88
Reboot affected hosts after the kernel update so the patched netfs code is loaded
Audit distributions and long-term support branches to confirm backports are present before returning workloads to production

Patch Information

The fix modifies netfs_invalidate_folio() to call folio_cancel_dirty() when all dirty data in the folio has been erased, matching NFS behavior. Tracepoints were added to record dirty-page modifications for future diagnosis. Distribution vendors ship the fix through stable kernel updates referenced in the upstream commits.

Workarounds

Enable fscaching on netfs-backed mounts, which suppresses the streaming write path that produces the vulnerable folio state
Restrict local user access to netfs-backed filesystems until patched kernels are deployed
Avoid workloads that combine streaming writes, truncation, and mmap() reads on the same file when running unpatched kernels

bash

# Verify the running kernel and confirm the patched commits are present
uname -r
git -C /usr/src/linux log --oneline | grep -E "156ac2e|31ba145|65ae871|fb6ec88"