Linux Kernel up to 7.0.10 Netfs i_size_read/i_size_write remote_i_size/zero_point locking

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.0.10. It has been classified as very critical. Affected by this issue is the function i_size_read/i_size_write of the component Netfs. The manipulation of the argument remote_i_size/zero_point leads to locking. This vulnerability is referenced as CVE-2026-64160. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.0.10. This issue affects the function i_size_read/i_size_write of the component Netfs. The manipulation of the argument remote_i_size/zero_point with an unknown input leads to a locking vulnerability. Using CWE to declare the problem leads to CWE-667. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-64160 since 07/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/19/2026).

Upgrading to version 7.0.11 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion