CVE-2026-64059: netfs: Fix folio->private handling in netfs_perform_write()
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix folio->private handling in netfsperformwrite()
Under some circumstances, netfsperformwrite() doesn't correctly manipulate folio->private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio struct, leading to potential multiple attachments of private data with associated folio ref leaks and also leaks of netfsfolio structs or netfsgroup refs.
Fix this by consolidating the place at which a folio is marked uptodate in one place and having that look at what's attached to folio->private and decide how to clean it up and then set the new group. Also, the content shouldn't be flushed if group is NULL, even if a group is specified in the netfsgroup parameter, as that would be the case for a new folio. A filesystem should always specify netfsgroup or never specify netfsgroup.
The Sashiko auto-review tool noted that it was theoretically possible that the fpos >= ctx->zeropoint section might leak if it modified a streaming write folio. This is unlikely, but with a network filesystem, third party changes can happen. It also pointed out that netfssetgroup() would leak if called multiple times on the same folio from the "whole folio modify section".
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access is needed to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the expected security impact?
The CVSS assessment indicates a high availability impact, with no confidentiality or integrity impact.
What should operators do to remediate this issue?
Apply the available Linux kernel patch. The supplied references identify stable kernel commits containing the fix.