CVE-2026-64158 Overview
CVE-2026-64158 is a Linux kernel vulnerability in the netfs subsystem. The flaw resides in the netfs_perform_write() function, which manages write streaming behavior for network filesystems. Write streaming caches dirty data in dirty but not-uptodate folios to avoid unnecessary reads before overwrites.
The kernel incorrectly disables write streaming when a file descriptor is opened with O_RDWR. This check is both unnecessary and ineffective, since a separate file descriptor opened for reading bypasses the protection. The condition also fails to account for updated netfs behavior where ->read_folio() fills in gaps automatically.
Critical Impact
Local attackers with low privileges can trigger data integrity issues and partial availability loss in network filesystem operations relying on netfs write streaming.
Affected Products
- Linux kernel versions containing the netfs subsystem write streaming implementation
- Network filesystem clients relying on netfs_perform_write() (e.g., AFS, Ceph, 9P, CIFS)
- Systems where fscache or content encryption interacts with netfs write paths
Discovery Timeline
- 2026-07-19 - CVE-2026-64158 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64158
Vulnerability Analysis
The vulnerability exists in the netfs write streaming logic within the Linux kernel. Write streaming is an optimization that caches dirty data in folios marked dirty but not uptodate. This avoids reading blocks that will be immediately overwritten.
The original design disabled write streaming under three conditions: file descriptors opened with O_RDWR, active fscache usage, and enabled content encryption. The O_RDWR check aimed to ensure the kernel could flush write-streaming pages before reads, particularly through mmap operations.
This logic is flawed. The netfs layer now fills gaps automatically when ->read_folio() is invoked on a folio. The check also fails to prevent the underlying issue because a process can open a separate read-only file descriptor and bypass the restriction entirely.
The flaw was exposed through failures in the generic/522 xfstest. Affected systems can experience data consistency issues in network filesystem workloads, with local low-privileged users able to trigger the condition.
Root Cause
The root cause is an obsolete and ineffective conditional check in netfs_perform_write() that disables write streaming when the file descriptor carries the O_RDWR flag. The check does not reflect current netfs read-folio behavior and does not cover multi-descriptor access patterns.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker manipulating file descriptors on netfs-backed storage can trigger inconsistent write-streaming states, impacting confidentiality and integrity of cached data. The vulnerability is a kernel-level file system issue [CWE-improper state handling].
No public proof-of-concept exploit code is available. See the upstream commits referenced in the Kernel Git Commit Change for the corrective patch.
Detection Methods for CVE-2026-64158
Indicators of Compromise
- Unexpected data corruption or stale reads on network filesystem mounts using netfs (AFS, Ceph, 9P, CIFS)
- generic/522 xfstest failures on kernels predating the fix
- Kernel log anomalies referencing netfs_perform_write write-streaming folio state mismatches
Detection Strategies
- Inventory running kernel versions across Linux endpoints and servers, correlating them with the fixed commits from kernel.org
- Monitor for local processes opening netfs-backed files with O_RDWR alongside concurrent read-only descriptors
- Audit filesystem consistency checks and application-level checksums on network-mounted storage
Monitoring Recommendations
- Enable kernel audit logging for file operations against netfs mount points
- Track syscalls (openat, mmap, write, read) referencing network filesystem paths for anomalous patterns
- Correlate kernel version telemetry with vulnerability databases to identify unpatched hosts
How to Mitigate CVE-2026-64158
Immediate Actions Required
- Identify all Linux systems running kernels with the vulnerable netfs write-streaming logic
- Apply the upstream kernel patches referenced in the kernel.org commits as soon as vendor builds are available
- Prioritize patching hosts that mount network filesystems (AFS, Ceph, 9P, CIFS) with local multi-user access
Patch Information
The fix removes the O_RDWR check from netfs_perform_write(), allowing streaming writes even when reads may occur. Refer to the upstream commits: 616578e40dcba3f94810d841c5a52b7e3bc8ede7, 70a7b9193bbbfceaab5974de66834c64ccc875dd, 7a9fa5b020a3a40f8291a71cd44c08d931da430d, and 9adf8e47d73d5e3c2fe77dea649dcde350ccd65c. Consume backports through your distribution's stable kernel channel.
Workarounds
- Restrict local user access to systems exposing netfs-backed mounts until patches are deployed
- Limit application logic that opens files with O_RDWR on network filesystems where feasible
- Disable fscache and content encryption paths that intersect with netfs write streaming if not required
# Verify running kernel version and check against fixed commits
uname -r
# Example: identify netfs-backed mounts
mount | grep -E 'ceph|afs|9p|cifs'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
