UBUNTU-CVE-2026-64064
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfs_folio struct hung off of folio->private indicating the dirty range. Subsequently truncating the file such that the dirty data in the folio is removed, but the first part of the folio theoretically remains will cause the netfs_folio struct to be discarded... but will leave the dirty flag set. If the folio is then read via mmap(), netfs_read_folio() will see that the page is dirty and jump to netfs_read_gaps() to fill in the missing bits. netfs_read_gaps(), however, expects there to be a netfs_folio struct present and can oops because truncate removed it. Fix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the event that all the dirty data in the folio is erased (as nfs does). Also add some tracepoints to log modifications to a dirty page. This can be reproduced with something like: dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1 umount /xfstest.test mount /xfstest.test xfs_io -c "w 0xbbbf 0xf96c" \ -c "truncate 0xbbbf" \ -c "mmap -r 0xb000 0x11000" \ -c "mr 0xb000 0x11000" \ /xfstest.test/foo with fscaching disabled (otherwise streaming writes are suppressed) and a change to netfs_perform_write() to disallow streaming writes if the fd is open O_RDWR: if (//(file->f_mode & FMODE_READ) || <--- comment this out netfs_is_cache_enabled(ctx)) { It should be reproducible even without this change, but if prevents the above trivial xfs_io command from reproducing it. Note that the initial dd is important: the file must start out sufficiently large that the zero-point logic doesn't just clear the gaps because it knows there's nothing in the file to read yet. Unmounting and mounting is needed to clear the pagecache (there are other ways to do that that may also work). This was initially reproduced with the generic/522 xfstest on some patches that remove the FMODE_READ restriction.
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
4 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
24 explicit affected versions
2 explicit affected versions
10 explicit affected versions
39 explicit affected versions
26 explicit affected versions
7 explicit affected versions
42 explicit affected versions
13 explicit affected versions
46 explicit affected versions
35 explicit affected versions
1 explicit affected versions
18 explicit affected versions
1 explicit affected versions
48 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
55 explicit affected versions
1 explicit affected versions
21 explicit affected versions
9 explicit affected versions
16 explicit affected versions
10 explicit affected versions
7 explicit affected versions
51 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
1 explicit affected versions
7 explicit affected versions
19 explicit affected versions
12 explicit affected versions
10 explicit affected versions
12 explicit affected versions
44 explicit affected versions
9 explicit affected versions
9 explicit affected versions
16 explicit affected versions
6 explicit affected versions
29 explicit affected versions
37 explicit affected versions
10 explicit affected versions
37 explicit affected versions
10 explicit affected versions
11 explicit affected versions
13 explicit affected versions
42 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
26 explicit affected versions
12 explicit affected versions
13 explicit affected versions
29 explicit affected versions
13 explicit affected versions
12 explicit affected versions
43 explicit affected versions
43 explicit affected versions
8 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
23 explicit affected versions
22 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
10 explicit affected versions
17 explicit affected versions
5 explicit affected versions
10 explicit affected versions
26 explicit affected versions
42 explicit affected versions
37 explicit affected versions
48 explicit affected versions
11 explicit affected versions
10 explicit affected versions
13 explicit affected versions
48 explicit affected versions
16 explicit affected versions
53 explicit affected versions
10 explicit affected versions
3 explicit affected versions
7 explicit affected versions
51 explicit affected versions
18 explicit affected versions
43 explicit affected versions
12 explicit affected versions
7 explicit affected versions
27 explicit affected versions
3 explicit affected versions
8 explicit affected versions
45 explicit affected versions
8 explicit affected versions
3 explicit affected versions
5 explicit affected versions
8 explicit affected versions
6 explicit affected versions
10 explicit affected versions
7 explicit affected versions
49 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
53 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
11 explicit affected versions
42 explicit affected versions
21 explicit affected versions
8 explicit affected versions
7 explicit affected versions
4 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
13 explicit affected versions
43 explicit affected versions
16 explicit affected versions
5 explicit affected versions
10 explicit affected versions
8 explicit affected versions
48 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
11 explicit affected versions
1 explicit affected versions
22 explicit affected versions
6 explicit affected versions
41 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfs_folio struct hung off of folio->private indicating the dirty range. Subsequently truncating the file such that the dirty data in the folio is removed, but the first part of the folio theoretically remains will cause the netfs_folio struct to be discarded... but will leave the dirty flag set. If the folio is then read via mmap(), netfs_read_folio() will see that the page is dirty and jump to netfs_read_gaps() to fill in the missing bits. netfs_read_gaps(), however, expects there to be a netfs_folio struct present and can oops because truncate removed it. Fix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the event that all the dirty data in the folio is erased (as nfs does). Also add some tracepoints to log modifications to a dirty page. This can be reproduced with something like: dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1 umount /xfstest.test mount /xfstest.test xfs_io -c "w 0xbbbf 0xf96c" \ -c "truncate 0xbbbf" \ -c "mmap -r 0xb000 0x11000" \ -c "mr 0xb000 0x11000" \ /xfstest.test/foo with fscaching disabled (otherwise streaming writes are suppressed) and a change to netfs_perform_write() to disallow streaming writes if the fd is open O_RDWR: if (//(file->f_mode & FMODE_READ) || <--- comment this out netfs_is_cache_enabled(ctx)) { It should be reproducible even without this change, but if prevents the above trivial xfs_io command from reproducing it. Note that the initial dd is important: the file must start out sufficiently large that the zero-point logic doesn't just clear the gaps because it knows there's nothing in the file to read yet. Unmounting and mounting is needed to clear the pagecache (there are other ways to do that that may also work). This was initially reproduced with the generic/522 xfstest on some patches that remove the FMODE_READ restriction.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/156ac2ec2ee77c44c4eb7439d6d165247ba12247
- https://ubuntu.com/security/CVE-2026-64064
- https://ubuntu.com/security/notices/USN-8593-1
- https://ubuntu.com/security/notices/USN-8603-1
- https://ubuntu.com/security/notices/USN-8618-1
- https://www.cve.org/CVERecord?id=CVE-2026-64064