CVE-2026-64059 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix folio->private handling in netfs_perform_write()
Under some circumstances, netfs_perform_write() doesn't correctly manipulate folio->private between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing to a group and pointing to a netfs_folio struct, leading to potential multiple attachments of private data with associated folio ref leaks and also leaks of netfs_folio structs or netfs_group refs.
Fix this by consolidating the place at which a folio is marked uptodate in one place and having that look at what's attached to folio->private and decide how to clean it up and then set the new group. Also, the content shouldn't be flushed if group is NULL, even if a group is specified in the netfs_group parameter, as that would be the case for a new folio. A filesystem should always specify netfs_group or never specify netfs_group.
The Sashiko auto-review tool noted that it was theoretically possible that the fpos >= ctx->zero_point section might leak if it modified a streaming write folio. This is unlikely, but with a network filesystem, third party changes can happen. It also pointed out that __netfs_set_group() would leak if called multiple times on the same folio from the "whole folio modify section".
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel's netfs subsystem represents a critical flaw in memory management and reference tracking within the network filesystem implementation. This issue manifests specifically within the netfs_perform_write() function where improper handling of folio->private data structures creates multiple pathways for resource leaks and memory corruption. The vulnerability stems from inadequate state management when transitioning between different folio private data states including NULL, NETFS_FOLIO_COPY_TO_CACHE, group pointers, and netfs_folio struct references. According to CWE-415, this represents an improper handling of memory resources where the kernel fails to properly manage reference counts and cleanup operations during folio state transitions.
The technical implementation flaw occurs when the system attempts to manipulate folio->private data without proper consolidation of cleanup logic, leading to scenarios where private data attachments can occur multiple times on the same folio structure. This creates a cascade of issues including folio reference leaks, netfs_folio struct memory leaks, and netfs_group reference count corruption. The kernel's handling of these transitions violates fundamental memory management principles by failing to maintain consistent state tracking and proper resource cleanup procedures. When a folio transitions between different states, the system should ensure that any existing private data is properly released before new references are established, yet this protective mechanism fails under certain conditional circumstances.
The operational impact of this vulnerability extends beyond simple memory leaks to potentially compromise system stability and security. Attackers could exploit these reference counting errors to cause denial of service conditions through resource exhaustion or potentially gain unauthorized access through memory corruption vulnerabilities. The risk is particularly elevated in network filesystem environments where third-party modifications can occur dynamically, as highlighted by the Sashiko auto-review tool's findings. These issues align with ATT&CK technique T1499.002 for network denial of service attacks and could enable privilege escalation through improper memory handling. The vulnerability affects critical kernel subsystems that manage file I/O operations, making it a high-severity concern for system administrators and security teams.
The fix implemented addresses the core issue by consolidating all folio marking operations into a single location where proper cleanup decisions can be made based on existing folio->private state information. This approach ensures that when transitioning to new group assignments, any previous private data attachments are properly cleaned up before establishing new references. The solution also implements proper validation logic to prevent content flushing when group is NULL, even if a netfs_group parameter is specified, maintaining consistency with filesystem expectations and preventing erroneous operations on new folios. This fix directly addresses CWE-416 by ensuring proper resource management and prevents the multiple attachment scenarios that could lead to memory corruption.
Additional mitigations include enhanced validation of the streaming write folio modification paths to prevent potential leaks when fpos >= ctx->zero_point conditions are encountered during network filesystem operations. The implementation now ensures that __netfs_set_group() calls properly handle multiple invocations on the same folio by maintaining consistent state tracking and cleanup procedures throughout the "whole folio modify section." These improvements align with industry best practices for kernel memory management and provide defense-in-depth protection against similar vulnerabilities in related subsystems. The enhanced validation also addresses potential race conditions that could occur during concurrent access to folio structures, particularly important in multi-threaded network filesystem environments where multiple processes might simultaneously modify the same file data structures.