CVE-2026-64065: netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

netfs: fix VMBUGONFOLIO() issue in netfswritebegin() call

The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%.

while true; do sudo ./check generic/013 done

[ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322 [ 9849.452412] memcg:ffff8881a1915800 [ 9849.452417] aops:cephaops ino:1000058db9e dentry name(?):"f9XXXXXX" [ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248 [ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800 [ 9849.452447] page dumped because: VMBUGONFOLIO(!foliotestlocked(folio)) [ 9849.452474] ------------[ cut here ]------------ [ 9849.452476] kernel BUG at mm/filemap.c:1504! [ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full) [ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1 0/2025 [ 9849.484539] RIP: 0010:foliounlock+0x85/0xa0 [ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84 [ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246 [ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000 [ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000 [ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000 [ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000 [ 9849.502516] FS: 00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000 [ 9849.502996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0 [ 9849.504459] PKRU: 55555554 [ 9849.504626] Call Trace: [ 9849.505242] <TASK> [ 9849.505379] netfswritebegin+0x7c8/0x10a0 [ 9849.505877] ? kasancheckread+0x11/0x20 [ 9849.506384] ? pfxnetfswritebegin+0x10/0x10 [ 9849.507178] cephwritebegin+0x8c/0x1c0 [ 9849.507934] genericperformwrite+0x391/0x8f0 [ 9849.508503] ? pfxgenericperformwrite+0x10/0x10 [ 9849.509062] ? fileupdatetimeflags+0x19a/0x4b0 [ 9849.509581] ? cephgetcaps+0x63/0xf0 [ 9849.510259] ? cephgetcaps+0x63/0xf0 [ 9849.510530] cephwriteiter+0xe79/0x1ae0 [ 9849.511282] ? pfxcephwriteiter+0x10/0x10 [ 9849.511839] ? lockacquire+0x1ad/0x310 [ 9849.512334] ? ksyswrite+0xf9/0x230 [ 9849.512582] ? lockisheldtype+0xaa/0x140 [ 9849.513128] vfswrite+0x512/0x1110 [ 9849.513634] ? fgetfiles+0x33/0x350 [ 9849.513893] ? pfxvfswrite+0x10/0x10 [ 9849.514143] ? mutexlocknested+0x1b/0x30 [ 9849.514394] ksyswrite+0xf9/0x230 [ 9849.514621] ? pfxksyswrite+0x10/0x10 [ 9849.514887] ? dosyscall64+0x25e/0x1520 [ 9849.515122] ? kasancheckread+0x11/0x20 [ 9849.515366] ? tracehardirqsonprepare+0x178/0x1c0 [ 9849.515655] x64syswrite+0x72/0xd0 [ 9849.515885] ? tracehardirqson+0x24/0x1c0 [ 9849.516130] x64syscall+0x22f/0x2390 [ 9849.516341] dosyscall64+0x12b/0x1520 [ 9849.516545] ? dosyscall64+0x27c/0x1520 [ 9849.516783] ? dosyscall64+0x27c/0x1520 [ 9849.517003] ? lockrelease+0x318/0x480 [ 9849.517220] ? x64sysiogetevents+0x143/0x2d0 [ 9849.517479] ? percpurefputmany.constprop.0+0x8f/0x210 [ 9849.517779] ? entrySYSCALL64afterhwframe+0x76/0x7e [ 9849.518073] ? dosyscall64+0x25e/0x1520 [ 9849.518291] ? kasancheckread+0x11/0x20 [ 9849.518519] ? tracehardirqsonprepare+0x178/0x1c0 [ 9849.518799] ? dosyscall64+0x27c/0x1520 [ 9 ---truncated---

Affected Software

8 affected components

Linux Linux kernel

Linux Linux kernel>=6.12<6.12.92

Linux Linux kernel>=6.13<6.18.34

Linux Linux kernel>=6.19<7.0.11

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 7.0.0-rc1+
Configuration
Apply the kernel fix described as: 'netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call' to resolve the folio/page refcount/mapcount bug triggering kernel BUG at mm/filemap.c:1504 (triggered during netfs_write_begin/ceph_write_begin -> generic_perform_write).
Linux kernel (netfs_write_begin) VM_BUG_ON_FOLIO() behavior = fixed
Compensating control
Mitigate the kernel BUG reproduction by not running the Linux kernel test-case 'generic/013' (e.g., avoid 'sudo ./check generic/013' as it can reproduce a BUG at mm/filemap.c:1504).

Event History

Jul 19, 2026

CVE Published

via MITRE·03:39 PM

Data Sourced

via MITRE·03:39 PM

Description

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to trigger this issue?

The CVSS vector indicates local access with low privileges is required. No user interaction is required.

What is the likely impact if the issue is triggered?

The issue can cause a kernel BUG at mm/filemap.c:1504, resulting in an invalid-opcode Oops. The reported CVSS impact is limited to availability.

How can I identify a possible occurrence on a system?

Check kernel logs for a page dump stating "VM_BUG_ON_FOLIO(!folio_test_locked(folio))" followed by "kernel BUG at mm/filemap.c:1504" and an invalid-opcode Oops. The reported reproduction involved repeated runs of the generic/013 filesystem test using fsstress and showed ceph_aops in the page information.