CVE-2026-80898 Overview
CVE-2026-80898 is a Linux kernel vulnerability in the network filesystem (netfs) subsystem. The flaw affects the copy-to-cache path where netfs_pgpriv2_copy_to_cache() marks a folio with the PG_private_2 page flag before netfs_pgpriv2_copy_folio() appends it to the copy-to-cache rolling buffer. When the append operation fails, the folio is not queued for cache writeback, and the PG_private_2 state and its associated reference are never released. This leaves stale page state and leaks a reference count on the folio.
Critical Impact
The flag leak can cause page reference leaks and inconsistent folio state during network filesystem cache operations, leading to memory pressure or subsequent kernel warnings.
Affected Products
- Linux Kernel (netfs subsystem)
- Distributions shipping affected stable kernel branches
- Network filesystems that use the netfs copy-to-cache helper (for example, AFS, Ceph, 9P, and CIFS/SMB clients relying on netfs)
Discovery Timeline
- 2026-09-04 - CVE-2026-80898 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80898
Vulnerability Analysis
The issue resides in the netfs page private v2 (pgpriv2) copy-to-cache logic. The helper netfs_pgpriv2_copy_to_cache() sets PG_private_2 on a folio to indicate that a copy-to-cache operation is pending. It then calls netfs_pgpriv2_copy_folio() to append the folio to a rolling buffer that a background worker drains into the local cache.
If the append step fails, control returns to the caller without queuing the folio for writeback. The cleanup path that clears PG_private_2 and drops the extra folio reference runs from the writeback completion callback. Because the folio never reaches writeback, that cleanup never runs. The result is a folio permanently marked with PG_private_2 and an unbalanced reference count.
Persistent PG_private_2 state can block folio reclaim, produce VM_BUG_ON warnings, and gradually leak memory under sustained network filesystem I/O. The fix explicitly clears the flag and releases the reference on the append failure path.
Root Cause
The root cause is an incomplete error path in the netfs copy-to-cache append operation. Ownership of the PG_private_2 flag and its reference is transferred to the rolling buffer only on success, but the failure path does not perform the compensating cleanup.
Attack Vector
The defect is triggered under legitimate netfs I/O when the append to the rolling buffer fails, for example due to allocation pressure. It is a resource management bug in the kernel rather than a remotely exploitable primitive, and no proof of concept or exploit is available. See the upstream commits for the exact code path.
The vulnerability is described in prose because no verified exploit code exists. Refer to the Kernel Git Commit 614b7f4, Kernel Git Commit 627826e, and Kernel Git Commit a81fc92 for the corrective changes.
Detection Methods for CVE-2026-80898
Indicators of Compromise
- Kernel log messages referencing netfs, PG_private_2, or VM_BUG_ON_FOLIO on hosts using cached network filesystems.
- Gradual, unexplained growth in unreclaimable page cache on systems performing sustained netfs reads with local caching enabled.
- Stalled or looping folio reclaim paths visible in /proc/pressure/memory and kernel stack traces.
Detection Strategies
- Inventory running kernels against the fixed commits listed in the upstream references and flag any host still on a vulnerable branch.
- Monitor dmesg for netfs-related warnings and cache writeback errors on nodes mounting AFS, Ceph, 9P, or SMB with fscache enabled.
- Correlate memory pressure events with network filesystem workloads to identify hosts most likely to trigger the failure path.
Monitoring Recommendations
- Ship kernel logs into a centralized logging pipeline and alert on repeated netfs or folio-state warnings.
- Track kernel package versions in configuration management to detect drift from patched builds.
- Baseline page cache and slab memory growth on fileserver clients to catch slow leaks tied to this defect.
How to Mitigate CVE-2026-80898
Immediate Actions Required
- Identify all Linux hosts using netfs-backed filesystems with local caching and prioritize them for patching.
- Upgrade to a stable kernel release that includes commits 614b7f4, 627826e, and a81fc92.
- Reboot patched systems to load the corrected kernel image and clear any leaked folio state.
Patch Information
The fix clears PG_private_2 and releases the folio reference when the copy-to-cache append fails. It has been merged into upstream stable branches through the following commits: Kernel Git Commit 614b7f4, Kernel Git Commit 627826e, and Kernel Git Commit a81fc92. Apply the kernel update provided by your Linux distribution once available.
Workarounds
- Disable fscache-backed local caching for netfs mounts where feasible until the kernel is patched.
- Reduce memory pressure on affected clients to lower the probability of append failures on the copy-to-cache path.
- Restart client systems periodically to reclaim leaked folio references if patching must be deferred.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
