CVE-2026-64156 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
netfs, afs: Fix write skipping in dir/link writepages
Fix netfs_write_single() and afs_single_writepages() to better handle a write that would be skipped due to lock contention and WB_SYNC_NONE by returning 1 from netfs_write_single() if it skipped and making afs_single_writepages() skip also. If a skip occurs, the inode must be re-marked as the VFS may have cleared the mark.
This is really only theoretical for directories in netfs_write_single() as the only path to that is through afs_single_writepages() that takes the ->validate_lock around it, thereby serialising it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability addressed in this linux kernel patch relates to improper handling of write operations within the network filesystem subsystem, specifically affecting the afs (Andrew File System) implementation. This issue occurs during directory and link writepage operations where concurrent access patterns can lead to inconsistent state management between the kernel's virtual filesystem layer and the actual file system implementation. The problem manifests when write operations intended for network filesystems are skipped due to lock contention while operating with WB_SYNC_NONE synchronization flags, creating a potential race condition that could result in data integrity issues or inconsistent file system states.
The technical flaw stems from the incorrect return value handling in the netfs_write_single() and afs_single_writepages() functions. When these functions encounter write operations that must be skipped due to lock contention, they fail to properly signal this skip condition back to the calling layer. The patch corrects this by ensuring netfs_write_single() returns a value of 1 when it skips a write operation, while also implementing corresponding logic in afs_single_writepages() to perform similar skipping behavior. This return value serves as a critical indicator to the kernel's writeback subsystem about whether the operation was actually processed or skipped due to resource constraints.
The operational impact of this vulnerability extends beyond simple performance degradation to potential data consistency issues within network filesystem environments. When the inode marking is cleared by the VFS layer but not properly restored by the afs implementation, it can lead to incorrect assumptions about file state and potentially cause subsequent operations to behave unexpectedly. This is particularly concerning in distributed file system scenarios where multiple processes might be accessing the same directory or link simultaneously, creating complex synchronization challenges that could compound under heavy load conditions.
The mitigation strategy implemented through this patch addresses the core synchronization issue by ensuring proper state management between kernel components during concurrent write operations. The fix specifically targets the scenario where lock contention prevents writes from proceeding while operating with WB_SYNC_NONE flags, which are designed for non-blocking write operations. By making afs_single_writepages() skip operations in the same manner as netfs_write_single(), the patch ensures consistent behavior across the entire writeback path and maintains proper inode state management throughout the operation lifecycle.
This vulnerability aligns with CWE-691, which addresses Insufficient Control Flow Management, specifically relating to improper handling of control flow during concurrent operations. The issue also maps to ATT&CK technique T1486, where adversaries might exploit similar synchronization flaws to manipulate file system states or create persistent access patterns. The implementation follows best practices for kernel-level resource management by ensuring proper return value signaling and state restoration in multi-threaded environments, which is essential for maintaining filesystem integrity under concurrent access patterns typical of network filesystem deployments.
The theoretical nature of this vulnerability as noted in the patch description indicates that it primarily affects directory operations within the afs implementation where the locking mechanism already provides sufficient serialization through the ->validate_lock path. However, the fix remains important because it ensures robust behavior even under edge cases and prevents potential escalation of similar issues in other network filesystem implementations that might not have identical locking guarantees. The patch demonstrates proper kernel development practices by addressing subtle race conditions that could manifest under specific load conditions but are critical to prevent in production environments where data consistency is paramount.
The broader implications of this fix extend to all network filesystem implementations that rely on similar writeback mechanisms, as it establishes a consistent pattern for handling skipped operations while maintaining proper inode state management. This approach aligns with kernel design principles that emphasize predictable behavior under concurrent access and proper resource cleanup even when operations are deferred or skipped due to system constraints. The solution maintains backward compatibility while strengthening the robustness of the filesystem layer against race conditions that could otherwise lead to data loss or corruption in distributed environments where multiple clients access shared resources simultaneously.