CVE-2026-64160 Overview
CVE-2026-64160 is a Linux kernel vulnerability in the network filesystem (netfs) subsystem. The flaw stems from potential tearing when reading or writing the ->remote_i_size and ->zero_point fields. Without proper synchronization through the i_size_seqcount, concurrent accesses can observe partially-updated values on architectures where 64-bit stores are not atomic. The kernel maintainers resolved the issue by adopting the same seqcount pattern used for i_size, requiring i_lock to be held during size updates in netfslib and dependent filesystems.
Critical Impact
Concurrent readers of netfs inode size fields can observe torn values, leading to filesystem state corruption and potential integrity or availability impact on affected Linux systems.
Affected Products
- Linux kernel builds containing the netfs subsystem prior to the fix commits
- Filesystems built on netfslib (network filesystem clients such as AFS, Ceph, 9p, CIFS/SMB, NFS variants using netfs)
- Downstream distribution kernels that have not yet backported the referenced stable patches
Discovery Timeline
- 2026-07-19 - CVE-2026-64160 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64160
Vulnerability Analysis
The Linux kernel netfs library tracks two size-related fields on each inode: ->remote_i_size, which reflects the server-side file size, and ->zero_point, which marks the boundary beyond which cached content is treated as zero-filled. Both values are 64-bit and can be updated while other CPUs read them concurrently.
Without serialized accessors, a reader on a 32-bit platform, or across weakly ordered memory operations, can observe half of an old value and half of a new value. This tearing can cause the netfs layer to misjudge cache validity, read past valid data, or return incorrect content to userspace. The fix mirrors the existing i_size_read() and i_size_write() pattern and reuses i_size_seqcount so all three size fields update atomically under i_lock.
Root Cause
The root cause is a missing synchronization primitive around 64-bit field updates. Direct reads and writes to ->remote_i_size and ->zero_point occurred without a seqcount or lock, so concurrent readers had no consistency guarantee against writers.
Attack Vector
The advisory does not describe a specific exploitation technique. The condition is triggered by concurrent filesystem operations against a netfs-backed mount, meaning a local workload that induces parallel reads and metadata updates on a network filesystem is sufficient to hit the race. The remote server can influence timing by returning size changes, but there is no evidence of a targeted remote exploitation primitive.
See the Kernel Git Commit 2c8f474 and Kernel Git Commit 55970f23 for the exact code changes.
Detection Methods for CVE-2026-64160
Indicators of Compromise
- No public indicators of compromise are associated with CVE-2026-64160; the flaw is a race condition rather than a payload-based attack.
- Unexpected kernel warnings, filesystem consistency errors, or netfs cache corruption entries in dmesg on hosts running network filesystems may indicate the race triggering in production.
Detection Strategies
- Inventory kernel versions across Linux endpoints and servers, and compare against the fixed stable branches referenced in the kernel git commits.
- Audit which hosts mount netfs-backed filesystems (AFS, Ceph, 9p, CIFS, NFS variants) since only those code paths exercise the vulnerable fields.
- Monitor kernel logs for netfs subsystem warnings, cache invalidation errors, or unexpected EIO returns from network filesystem operations.
Monitoring Recommendations
- Ingest /var/log/kern.log and journalctl -k output into a central log platform to surface netfs anomalies at scale.
- Track kernel package versions through configuration management to confirm patched builds are deployed fleet-wide.
- Alert on filesystem integrity check failures on hosts serving or consuming netfs mounts.
How to Mitigate CVE-2026-64160
Immediate Actions Required
- Identify Linux hosts running kernels that predate the referenced stable commits and prioritize those with active network filesystem mounts.
- Apply the vendor kernel update from your distribution as soon as the backported fix is available.
- Reboot affected systems after upgrading, since the fix lives inside the kernel image and cannot be hot-patched without kernel live-patch tooling.
Patch Information
The fix is contained in the upstream Linux kernel commits 2c8f4742bb76 and 55970f238d49. Both patches move ->remote_i_size and ->zero_point under the i_size_seqcount protection and enforce that i_lock be held during updates. Distribution vendors will ship these commits through their standard stable kernel update channels.
Workarounds
- No documented software workaround exists; the race is inherent to the field access pattern and requires the code change.
- As a risk-reduction measure, limit exposure by unmounting non-essential netfs-backed filesystems on unpatched hosts until updates land.
- Restrict local access on multi-user systems that heavily use network filesystems, reducing the likelihood of triggering the race in production workloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
