CVE-2026-64159 Overview
CVE-2026-64159 is a Linux kernel vulnerability in the network filesystem (netfs) subsystem. The flaw resides in netfs_release_folio(), which incorrectly updates the zero_point value when uncommitted pagecache data extends beyond the folio being released. The routine compares against the local i_size rather than remote_i_size, producing inconsistent read behavior for cached network filesystem clients such as CIFS.
The issue was reproduced with the fsx filesystem exerciser on CIFS using the default cache option, causing short reads at folio boundaries when FMODE_READ handling is bypassed in netfs_perform_write(). The bug affects data consistency but does not, on public information, enable code execution.
Critical Impact
Incorrect zero_point calculation causes short reads and stale zero returns for cached network filesystems, undermining data integrity on CIFS and other netfs-backed mounts.
Affected Products
- Linux kernel netfs subsystem (mainline)
- CIFS client using default caching
- Stable kernel branches receiving the netfs backport
Discovery Timeline
- 2026-07-19 - CVE-2026-64159 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64159
Vulnerability Analysis
The netfs subsystem tracks a zero_point value representing the file offset beyond which the client can safely assume the server returns only zeros. This optimization avoids issuing unnecessary read requests to the remote server. When a folio is released via netfs_release_folio(), the kernel must recompute zero_point to reflect the state of remaining pagecache and server data.
The defect appears when i_size > remote_i_size, meaning the local pagecache has been extended with data that has not yet been written back to the server. Under this condition, netfs_release_folio() bounded zero_point using i_size instead of remote_i_size. Because i_size reflects local writes only, the kernel could conclude that server-side data existed where it did not, producing short reads at end-of-file boundaries.
Root Cause
The root cause is an incorrect boundary variable in the zero_point update logic. remote_i_size mirrors the authoritative server-side file length, while i_size mirrors the local pagecache extent. Using i_size conflates local uncommitted writes with server-visible state, breaking the assumption zero_point encodes.
Attack Vector
This is a data-consistency defect triggered by ordinary filesystem I/O workloads on cached netfs mounts. It is not documented as remotely exploitable for code execution. Reproduction requires interleaved writes, mapread, copy_range, and truncate operations against a CIFS mount, as demonstrated with the fsx reproducer and the generic/522 xfstest.
The vulnerability manifests during standard read paths after folio release. Refer to the Kernel Git Commit Fix and the Kernel Git Commit Update for the corrective patches.
Detection Methods for CVE-2026-64159
Indicators of Compromise
- Short reads at end-of-file on CIFS mounts using default caching, particularly on folios containing the server-side EOF.
- Failures in the generic/522 xfstest against netfs-backed filesystems.
- Unexpected zero-filled regions returned to applications after mixed write and copy_range workloads.
Detection Strategies
- Run the fsx reproducer and the generic/522 xfstest against CIFS or other netfs-backed mounts on kernels not carrying the fix.
- Compare kernel build hashes against 4543a4d737944134a1394afe797622546fbcc98a and 5cd5207de519ef0c085f4f559adf5eefcb4c5202 to confirm patch presence.
- Audit deployed kernels for the vulnerable window using distribution security trackers.
Monitoring Recommendations
- Alert on application-level read failures or checksum mismatches against files stored on CIFS shares.
- Log kernel versions across the fleet and correlate with the netfs patch status.
- Track file integrity results for workloads relying on cached network filesystem access.
How to Mitigate CVE-2026-64159
Immediate Actions Required
- Update affected Linux kernels to a stable release containing commits 4543a4d737944134a1394afe797622546fbcc98a and 5cd5207de519ef0c085f4f559adf5eefcb4c5202.
- Prioritize hosts using CIFS or other netfs-backed mounts with client-side caching enabled.
- Verify integrity of files written or copied on affected clients before rolling out replacements.
Patch Information
The fix limits the zero_point update in netfs_release_folio() to remote_i_size rather than i_size, ensuring the value reflects server-visible file length. The corrective commits are available in the mainline and stable kernel trees. See the Kernel Git Commit Fix and the Kernel Git Commit Update.
Workarounds
- Mount CIFS shares with caching disabled (for example, cache=none) until the kernel patch can be deployed.
- Avoid workloads that mix write, copy_range, and mapread operations on network-mounted files on unpatched systems.
- Restrict production use of netfs-backed caches on kernels lacking the fix.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
