CVE-2026-64065: Linux Kernel netfs Write Vulnerability

CVE-2026-64065 Overview

CVE-2026-64065 is a Linux kernel vulnerability in the network filesystem (netfs) helper library. The flaw triggers a VM_BUG_ON_FOLIO(!folio_test_locked(folio)) assertion at mm/filemap.c:1504 inside the netfs_write_begin() code path. Running the generic/013 fstests workload against a Ceph mount reproduces the kernel BUG with roughly 30% probability. The condition results in a kernel oops and system instability, producing a local denial-of-service on affected kernels.

Critical Impact
A local unprivileged user performing routine file writes on a netfs-backed filesystem such as Ceph can trigger a kernel BUG and crash the affected system.

Affected Products

Linux kernel builds shipping the netfs helper library and netfs_write_begin() call path
Ceph filesystem client (ceph_write_begin → netfs_write_begin) on affected kernels
Downstream distributions consuming the affected mainline commits prior to the fix

Discovery Timeline

2026-07-19 - CVE-2026-64065 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64065

Vulnerability Analysis

The vulnerability lives in the Linux kernel netfs helper netfs_write_begin(), which prepares a folio for a buffered write on network filesystems such as Ceph. The function is expected to return a folio in the locked state so that the caller and later folio_unlock() calls operate on a locked page. Under the reproducer while true; do sudo ./check generic/013; done, the folio reaches folio_unlock+0x85 while folio_test_locked() returns false. The VM_BUG_ON_FOLIO assertion in mm/filemap.c then panics the kernel with an invalid opcode oops. The call stack traverses ksys_write → vfs_write → ceph_write_iter → generic_perform_write → ceph_write_begin → netfs_write_begin → folio_unlock, confirming the write path as the trigger.

Root Cause

The root cause is a folio state management defect in netfs_write_begin(). Under specific races reproducible with the generic/013 test case, the helper reaches an unlock path with a folio that is no longer locked. Because the folio locking invariant is enforced by VM_BUG_ON_FOLIO, any deviation converts a logic error into a fatal kernel assertion rather than a recoverable EIO.

Attack Vector

Exploitation requires local access and the ability to issue writes against a netfs-backed filesystem such as Ceph. No special privileges are required beyond write permission on a mounted target. Repeated write workloads increase the probability of hitting the race. The observable outcome is a kernel BUG and denial of service. There is no public evidence of remote triggering, code execution, or privilege escalation associated with this identifier at time of writing.

No verified proof-of-concept code is available. The upstream commit series referenced by the advisory describes the corrective changes. See the Kernel Git Commit dc7832d and Kernel Git Commit b639712 for the authoritative fix.

Detection Methods for CVE-2026-64065

Indicators of Compromise

Kernel log entries containing VM_BUG_ON_FOLIO(!folio_test_locked(folio)) originating from mm/filemap.c:1504.
Oops traces showing folio_unlock+0x85 called from netfs_write_begin and ceph_write_begin.
Repeated crashes on hosts running fsstress or xfstestsgeneric/013 against Ceph or other netfs-backed mounts.

Detection Strategies

Monitor dmesg, journalctl -k, and centralized syslog for kernel BUG, invalid opcode, and netfs_write_begin stack frames.
Correlate host reboots and kernel panics with active Ceph or netfs write workloads to distinguish this defect from unrelated crashes.
Compare running kernel commit hash against the fix commits listed in the advisory to identify unpatched hosts at scale.

Monitoring Recommendations

Forward kernel ring buffer messages to a central log store and alert on VM_BUG_ON_FOLIO and netfs_write_begin substrings.
Track kernel version inventory across fleets and flag hosts running vulnerable pre-fix builds.
On Ceph clients, enable crash dump collection (kdump) so that any recurrence produces a full vmcore for triage.

How to Mitigate CVE-2026-64065

Immediate Actions Required

Apply the upstream stable kernel updates that include the netfs folio locking fix and reboot affected hosts.
Prioritize patching on nodes acting as Ceph clients or otherwise mounting netfs-backed filesystems with heavy write activity.
Restrict untrusted local users from issuing sustained write workloads against affected mounts until patching is complete.

Patch Information

The fix is available in the mainline and stable trees through the referenced commits: Kernel Git Commit 51ffb78, Kernel Git Commit 5ad05b6, Kernel Git Commit b639712, and Kernel Git Commit dc7832d. Consume the corresponding stable point release from your Linux distribution rather than cherry-picking manually where possible.

Workarounds

Where patching is delayed, avoid running xfstests or similar sustained write stress workloads on Ceph clients in production.
Consider migrating workloads temporarily to filesystems that do not traverse the netfs_write_begin() path on unpatched hosts.
Enable kdump and automatic reboot on panic (kernel.panic = 10) so that a triggered BUG produces diagnostics and restores service quickly.

bash

# Verify running kernel and confirm it contains the fix commits
uname -r
rpm -q --changelog kernel | grep -E 'netfs_write_begin|VM_BUG_ON_FOLIO' || \
  dpkg -s linux-image-$(uname -r) | grep -i version

# Ensure kdump captures any recurrence
systemctl enable --now kdump
sysctl -w kernel.panic=10