CVE-2026-64156: Linux Kernel Write Skipping Vulnerability

CVE-2026-64156 Overview

CVE-2026-64156 addresses a Linux kernel issue in the netfs and Andrew File System (AFS) subsystems. The flaw affects how netfs_write_single() and afs_single_writepages() handle writeback operations when a write is skipped due to lock contention under WB_SYNC_NONE semantics. When the Virtual File System (VFS) clears the writeback mark and the write is skipped, the inode is not properly re-marked, which can lead to writeback state inconsistency for directory and symlink pages.

Critical Impact
Incorrect writeback state handling in AFS directory and link operations may cause dirty pages to be silently dropped from writeback tracking, resulting in filesystem consistency issues.

Affected Products

Linux kernel netfs subsystem
Linux kernel AFS (Andrew File System) client
Stable kernel branches referenced by the upstream commits

Discovery Timeline

2026-07-19 - CVE-2026-64156 published to the National Vulnerability Database (NVD)
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64156

Vulnerability Analysis

The issue resides in the netfs library shared by network filesystems such as AFS. The functions netfs_write_single() and afs_single_writepages() are responsible for writing single-object content, such as directory contents or symbolic link data, back to the server.

Under WB_SYNC_NONE writeback mode, the kernel performs non-blocking writeback. When lock contention occurs, the write can be skipped. The original implementation did not correctly signal a skip back to the caller, and the inode was left without its writeback mark reinstated after the VFS had cleared it.

The patch modifies netfs_write_single() to return 1 when it skips a write and updates afs_single_writepages() to propagate that skip behavior. On skip, the inode is re-marked so that subsequent writeback attempts can retry the operation.

Root Cause

The root cause is a state-tracking gap between the VFS writeback machinery and the netfs/AFS writepages implementations. The VFS clears the dirty or writeback mark before invoking writepages. When the netfs layer aborted due to lock contention without signaling the skip, the mark was never restored, leaving pending writes untracked.

Attack Vector

This is a kernel correctness fix rather than an externally reachable exploitation primitive. Impact is limited to systems mounting AFS volumes where concurrent writeback operations trigger lock contention. No remote attack vector, privilege escalation path, or memory corruption primitive has been publicly documented. See the upstream commits 77bb2930, 9871938f, and f91e1043 for the exact source-level changes.

Detection Methods for CVE-2026-64156

Indicators of Compromise

No known indicators of compromise are associated with this fix, as it addresses a filesystem correctness bug rather than a malicious code path.
Filesystem inconsistency reports on AFS-mounted volumes may indirectly indicate exposure to the underlying defect.

Detection Strategies

Enumerate running kernel versions across the fleet and cross-reference against the fixed commit hashes 77bb2930, 9871938f, and f91e10435c0d.
Identify hosts that mount AFS volumes using mount output or /proc/mounts inventory collection.
Review kernel logs for AFS writeback anomalies or repeated dirty-page retries under load.

Monitoring Recommendations

Monitor kernel messages via dmesg and journalctl -k for AFS-related warnings during high-concurrency writeback.
Track kernel package versions through configuration management to confirm patched builds are deployed.
Alert on unexpected filesystem consistency errors reported by AFS clients.

How to Mitigate CVE-2026-64156

Immediate Actions Required

Apply the stable kernel update containing commits 77bb293049d6, 9871938f99cc, and f91e10435c0d from your distribution.
Inventory all Linux hosts running AFS client workloads and prioritize them for patching.
Reboot into the patched kernel after installation to ensure the new netfs and AFS code paths are loaded.

Patch Information

The fix is available upstream in the Linux kernel stable tree. Refer to the Kernel Git Commit Update, the Kernel Git Commit Change, and the Kernel Git Commit Revision for the corresponding source changes. Consume the fix through your Linux distribution's stable kernel package.

Workarounds

No supported workaround replaces the kernel patch; apply the vendor-supplied update.
Where patching is delayed, avoid workloads that generate high concurrency on AFS directories and symlinks to reduce the chance of triggering the skip path.

bash

# Verify current kernel version and confirm patched build is running
uname -r

# Check for AFS mounts on the host
grep -E 'afs' /proc/mounts

# Apply distribution kernel updates (example for Debian/Ubuntu)
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot