CVE-2026-64159 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix zeropoint update where i_size > remote_i_size
Fix the update of the zero point[*] by netfs_release_folio() when there is
uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_size tracks the server's i_size.
[*] The zero point is the file position from which we can assume that the
server will just return zeros, so we can avoid generating reads.
Note that netfs_invalidate_folio() probably doesn't need fixing as zero_point should be updated by setattr after truncation or fallocate.
Found with:
fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops
using the following as junk.fsxops:
truncate 0x0 0x1bbae 0x82864 write 0x3ef2e 0xf9c8 0x1bbae write 0x67e05 0xcb5a 0x4e8f6 mapread 0x57781 0x85b6 0x7495f copy_range 0x5d3d 0x10329 0x54fac 0x7495f write 0x64710 0x1c2b 0x7495f mapread 0x64000 0x1000 0x7495f
on cifs with the default cache option.
It shows read-gaps on folio 0x64 failing with a short read (ie. it hits EOF) if the FMODE_READ check is commented out in netfs_perform_write():
if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) {
and no fscache. This was initially found with the generic/522 xfstest.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's network filesystem implementation where improper handling of zero point calculation during folio release operations creates a potential data inconsistency scenario. The issue specifically occurs in the netfs_release_folio() function when managing page cache entries that contain uncommitted data extending beyond the current folio being released, while the server-side file size (remote_i_size) is smaller than the local file size (i_size). This discrepancy arises because i_size represents local modifications to the page cache that may not yet be committed to the remote server, whereas remote_i_size accurately reflects the actual server-side file boundaries.
The technical flaw stems from incorrect zero point calculation where the system fails to properly constrain the zero_point value to remote_i_size instead of allowing it to extend to i_size. This creates a scenario where the kernel incorrectly assumes that data beyond the server's EOF boundary should return zeros, leading to potential read gaps and short reads during file operations. The zero point mechanism is designed to optimize network filesystem performance by avoiding unnecessary reads from the server when data is known to be zero, but this optimization becomes problematic when the calculation does not account for the distinction between local and remote file state boundaries.
The operational impact of this vulnerability manifests as inconsistent read behavior on network filesystems such as CIFS, particularly when using default caching options. When the FMODE_READ check is disabled in netfs_perform_write(), the system exhibits short read failures during folio operations, specifically at position 0x64 in the test scenario. This failure mode occurs because the kernel's assumption about where zeros begin becomes incorrect, causing read operations to terminate prematurely at what should be the server's actual EOF boundary rather than allowing proper data retrieval from the network filesystem.
The vulnerability was discovered through extensive testing using fsx with specific parameters designed to stress test file system operations, specifically targeting scenarios involving truncate, write, and copy_range operations that create complex page cache states. The test sequence demonstrates how a combination of file operations can create conditions where local i_size exceeds remote_i_size while maintaining uncommitted data in the page cache beyond the server's actual file boundaries. This finding aligns with common attack patterns identified in the ATT&CK framework under persistence and privilege escalation techniques, as filesystem inconsistencies could potentially be exploited to manipulate file content or access control boundaries.
The fix implemented addresses this by ensuring that zero_point calculations are constrained to remote_i_size rather than allowing them to extend to i_size, thereby maintaining proper synchronization between local page cache state and actual server-side file boundaries. This solution prevents the generation of incorrect read requests that would otherwise attempt to fetch data beyond the server's EOF, while maintaining the performance benefits of the zero point optimization mechanism. The issue also highlights the importance of proper cache coherency mechanisms in distributed filesystem implementations, aligning with CWE category 129 which addresses improper validation of array indices and similar buffer overflow conditions in network filesystem contexts.