{"id":"CVE-2026-64159","revision":"df7eeafc7aaf403898b3d54cd2a14c1b","records":[{"revision":"df7eeafc7aaf403898b3d54cd2a14c1b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64159","aliases":[],"title":"netfs: Fix zeropoint update where i_size > remote_i_size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix zeropoint update where i_size > remote_i_size\n\nFix the update of the zero point[*] by netfs_release_folio() when there is\nuncommitted data in the pagecache beyond the folio being released but the\non-server EOF is in this folio (ie. i_size > remote_i_size).  The update\nneeds to limit zero_point to remote_i_size, not i_size as i_size is a local\nphenomenon reflecting updates made locally to the pagecache, not stuff\nwritten to the server.  remote_i_size tracks the server's i_size.\n\n[*] The zero point is the file position from which we can assume that the\n    server will just return zeros, so we can avoid generating reads.\n\nNote that netfs_invalidate_folio() probably doesn't need fixing as\nzero_point should be updated by setattr after truncation or fallocate.\n\nFound with:\n\n    fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\n        /xfstest.test/junk --replay-ops=junk.fsxops\n\nusing the following as junk.fsxops:\n\n    truncate 0x0 0x1bbae 0x82864\n    write 0x3ef2e 0xf9c8 0x1bbae\n    write 0x67e05 0xcb5a 0x4e8f6\n    mapread 0x57781 0x85b6 0x7495f\n    copy_range 0x5d3d 0x10329 0x54fac 0x7495f\n    write 0x64710 0x1c2b 0x7495f\n    mapread 0x64000 0x1000 0x7495f\n\non cifs with the default cache option.\n\nIt shows read-gaps on folio 0x64 failing with a short read (ie. it hits\nEOF) if the FMODE_READ check is commented out in netfs_perform_write():\n\n                if (//(file->f_mode & FMODE_READ) ||\n                    netfs_is_cache_enabled(ctx)) {\n\nand no fscache.  This was initially found with the generic/522 xfstest.","state":0,"publishedAt":"2026-07-19T15:40:46.4+00:00","modifiedAt":"2026-10-21T12:43:09.056+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/netfs/misc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"cce6bfa6ca0e30af9927b0074c97fe6a92f28092\",\n                            \"lessThan\": \"f706e3889ff75877ecb3abae5ad667dbc990331e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cce6bfa6ca0e30af9927b0074c97fe6a92f28092\",\n                            \"lessThan\": \"5afc2d9b86bed2e4d9e1ba467790cbc793223f98\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cce6bfa6ca0e30af9927b0074c97fe6a92f28092\",\n                            \"lessThan\": \"5cd5207de519ef0c085f4f559adf5eefcb4c5202\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cce6bfa6ca0e30af9927b0074c97fe6a92f28092\",\n                            \"lessThan\": \"4543a4d737944134a1394afe797622546fbcc98a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2814004138a541110d4b2dc254a8f619c2c4ce0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.10.8\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/netfs/misc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.11\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f706e3889ff75877ecb3abae5ad667dbc990331e","https://git.kernel.org/stable/c/5afc2d9b86bed2e4d9e1ba467790cbc793223f98","https://git.kernel.org/stable/c/5cd5207de519ef0c085f4f559adf5eefcb4c5202","https://git.kernel.org/stable/c/4543a4d737944134a1394afe797622546fbcc98a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64159","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64159","identifiers":["CVE-2026-64159"]},"retained":false,"historicalAffected":[]}],"coverage":[]}