CVE-2026-80898: netfs: clear PG_private_2 on copy-to-cache append failure
In the Linux kernel, the following vulnerability has been resolved:
netfs: clear PGprivate2 on copy-to-cache append failure
netfspgpriv2copytocache() marks the folio with PGprivate2 before netfspgpriv2copyfolio() appends it to the copy-to-cache rolling buffer.
If the append fails, the folio is not queued for cache writeback, so the PGprivate2 state and its reference must be released immediately.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the affected error path?
The issue is triggered when a folio has been marked with PG_private_2 for copy-to-cache processing, but appending that folio to the copy-to-cache rolling buffer fails.
What is the impact of an append failure before the fix?
The folio is not queued for cache writeback, but its PG_private_2 state and associated reference are not released immediately. This leaves stale folio state and a retained reference on that failure path.
How can I determine whether a kernel includes the fix?
Check whether the kernel source or applied stable patches includes any of the referenced commits: 627826ef4208042b0470d1a3fdb729ce35471a0d1, 614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e, or a81fc9266e1c5fef9ccf675a9b44b2f4ab464923.