CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix netfsinvalidatefolio() to clear dirty bit if all changes gone
If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfsfolio struct hung off of folio->private indicating the dirty range. Subsequently truncating the file such that the dirty data in the folio is removed, but the first part of the folio theoretically remains will cause the netfsfolio struct to be discarded... but will leave the dirty flag set.
If the folio is then read via mmap(), netfsreadfolio() will see that the page is dirty and jump to netfsreadgaps() to fill in the missing bits. netfsreadgaps(), however, expects there to be a netfsfolio struct present and can oops because truncate removed it.
Fix this by calling foliocanceldirty() in netfsinvalidatefolio() in the event that all the dirty data in the folio is erased (as nfs does).
Also add some tracepoints to log modifications to a dirty page.
This can be reproduced with something like:
dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1 umount /xfstest.test mount /xfstest.test xfsio -c "w 0xbbbf 0xf96c" \ -c "truncate 0xbbbf" \ -c "mmap -r 0xb000 0x11000" \ -c "mr 0xb000 0x11000" \ /xfstest.test/foo
with fscaching disabled (otherwise streaming writes are suppressed) and a change to netfsperformwrite() to disallow streaming writes if the fd is open ORDWR:
if (//(file->fmode & FMODEREAD) || <--- comment this out netfsiscacheenabled(ctx)) {
It should be reproducible even without this change, but if prevents the above trivial xfsio command from reproducing it.
Note that the initial dd is important: the file must start out sufficiently large that the zero-point logic doesn't just clear the gaps because it knows there's nothing in the file to read yet. Unmounting and mounting is needed to clear the pagecache (there are other ways to do that that may also work).
This was initially reproduced with the generic/522 xfstest on some patches that remove the FMODEREAD restriction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel netfsto a version that resolves this vulnerability.Fixed in netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone - Configuration
Disable fscaching (so that streaming writes are not suppressed) when applying/validating the fix; the text notes reproducibility requires fscaching disabled.
netfs (NFS/NetFS caching behavior) fscaching disabled = disabled - Configuration
Do not enforce the FMODE_READ restriction in netfs logic; the text indicates that removing this restriction leads to the buggy path and is involved in disallowing streaming writes if the fd is not suitable for reading.
netfs streaming writes gate (FMODE_READ restriction) (file->f_mode & FMODE_READ) check = commented out/removed - Operational
If a streaming write is made, ensure the relevant modified folio is invalidated/cleared so mmap/reads don’t observe a dirty-but-not-up-to-date netfs folio state; this is the behavior intended by calling folio_cancel_dirty() in netfs_invalidate_folio().
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
An attacker or local user needs local access sufficient to perform writes, truncate a file, and read it through mmap(). The affected sequence involves a streaming write that leaves a folio dirty, truncation that removes all dirty data while leaving part of the folio, and a subsequent mmap read.
What is the impact if the issue is triggered?
The kernel can oops when netfs_read_gaps() expects a netfs_folio structure that truncation has already discarded. The CVSS vector rates the impact as availability-only, with high availability impact and no confidentiality or integrity impact.
How can administrators identify potentially affected workloads?
Look for workloads using netfs-backed files that combine streaming writes, file truncation, and mmap reads of the same file. The fix also adds tracepoints for logging modifications to dirty pages, which may assist investigation on kernels containing the resolved change.
What changes mitigate the issue?
Apply a Linux kernel update containing the netfs_invalidate_folio() change that calls folio_cancel_dirty() when all dirty data in a folio has been erased. Until an update can be applied, avoid the triggering workflow of streaming writes followed by truncation and mmap reads on affected netfs files.