CVE-2026-64157 Overview
CVE-2026-64157 is a Linux kernel vulnerability in the network filesystem (netfs) subsystem. The flaw resides in netfs_invalidate_folio(), where partial invalidation of a streaming-write folio incorrectly recalculates the dirty region boundary. When a partial invalidation overlaps the front (but not all) of a dirty write cached in a streaming-write page, the function moves the dirty region forward by setting the region start to the start of the invalidation range rather than its end. This results in incorrect tracking of dirty data within a netfs_folio structure, potentially leading to data integrity issues in cached writes to network filesystems.
Critical Impact
Incorrect dirty-region tracking during partial folio invalidation can corrupt in-flight streaming writes on netfs-backed filesystems, affecting data consistency.
Affected Products
- Linux kernel (netfs subsystem)
- Network filesystems built on the netfs helper library (e.g., AFS, Ceph, 9P, CIFS/SMB clients using netfs)
- Distributions shipping vulnerable kernel builds prior to the referenced stable commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64157 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64157
Vulnerability Analysis
The defect lies in netfs_invalidate_folio() inside the Linux kernel's netfs layer. Streaming writes use a netfs_folio structure to track a dirty region within a folio that is not yet uptodate. When userspace or the VFS triggers a partial invalidation of such a folio, the function must adjust the dirty region so it no longer overlaps the invalidated range.
The function correctly detects the case where the invalidation overlaps the front of the dirty region but not the entire region. However, it updates finfo->dirty_offset using the start offset of the invalidation range instead of the end offset. As a result, the dirty region no longer excludes the invalidated bytes and instead expands or shifts incorrectly. This can cause the kernel to write back stale or invalidated data, or to miscalculate the extent of pending dirty content.
Root Cause
The root cause is an off-by-boundary logic error [CWE-682-class]. The corrective patches set finfo->dirty_offset to iend, the end of the invalidation range, so the tracked dirty region begins immediately after the invalidated bytes. See the fix in Kernel Git Commit 3d9601c0, Kernel Git Commit 6a3d2711, Kernel Git Commit 6d91acc7, and Kernel Git Commit f6b2569a.
Attack Vector
The attack vector is local and requires filesystem activity that triggers partial folio invalidation against a streaming write in a netfs-backed mount. Triggering the condition requires a workload that mixes buffered streaming writes with operations causing partial page invalidation on a network filesystem client. The vulnerability is a correctness bug affecting data integrity rather than a memory-safety primitive granting code execution.
No verified public exploit code is available. The vulnerability is described in prose based on the upstream commit message; see the referenced kernel commits for the exact source diff.
Detection Methods for CVE-2026-64157
Indicators of Compromise
- Unexplained data corruption or truncation in files written over netfs-backed filesystems (AFS, Ceph, CIFS, 9P)
- Kernel logs showing writeback anomalies or netfs streaming-write inconsistencies on affected mounts
- Application-level checksum or hash mismatches on files recently written with mixed invalidation patterns
Detection Strategies
- Inventory running kernel versions against the fixed commits referenced in kernel.org stable trees
- Compare kernel build IDs on endpoints and servers to the patched versions distributed by each Linux vendor
- Correlate filesystem integrity check failures on network mounts with kernel versions predating the fix
Monitoring Recommendations
- Monitor dmesg and journal output for netfs-related warnings on hosts mounting network filesystems
- Track kernel package versions in configuration management and alert on hosts missing the netfs invalidation fix
- Enable filesystem integrity monitoring on critical directories served over netfs-backed mounts
How to Mitigate CVE-2026-64157
Immediate Actions Required
- Apply the kernel updates from your distribution that incorporate the netfs streaming-write invalidation fix
- Prioritize patching hosts that mount AFS, Ceph, CIFS, or 9P network filesystems with heavy buffered write workloads
- Reboot systems after upgrading to ensure the patched kernel is active
Patch Information
Upstream fixes are available in the Linux stable trees. Refer to Kernel Git Commit 3d9601c0, Kernel Git Commit 6a3d2711, Kernel Git Commit 6d91acc7, and Kernel Git Commit f6b2569a. Consume the fix through your distribution's kernel update channel where possible.
Workarounds
- Reduce exposure by minimizing mixed buffered-write and partial-invalidation workloads on netfs-backed mounts until patched
- Prefer synchronous I/O (O_SYNC or O_DIRECT) for critical write paths where feasible to bypass streaming-write folio caching
- Validate written data with application-level checksums on network filesystems until the kernel is updated
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
