CVE-2026-64159

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64159", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.038Z", "datePublished": "2026-07-19T15:40:46.400Z", "dateUpdated": "2026-10-21T12:43:09.056Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:43:09.056Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix zeropoint update where i_size > remote_i_size\n\nFix the update of the zero point[*] by netfs_release_folio() when there is\nuncommitted data in the pagecache beyond the folio being released but the\non-server EOF is in this folio (ie. i_size > remote_i_size). The update\nneeds to limit zero_point to remote_i_size, not i_size as i_size is a local\nphenomenon reflecting updates made locally to the pagecache, not stuff\nwritten to the server. remote_i_size tracks the server's i_size.\n\n[*] The zero point is the file position from which we can assume that the\n server will just return zeros, so we can avoid generating reads.\n\nNote that netfs_invalidate_folio() probably doesn't need fixing as\nzero_point should be updated by setattr after truncation or fallocate.\n\nFound with:\n\n fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\n /xfstest.test/junk --replay-ops=junk.fsxops\n\nusing the following as junk.fsxops:\n\n truncate 0x0 0x1bbae 0x82864\n write 0x3ef2e 0xf9c8 0x1bbae\n write 0x67e05 0xcb5a 0x4e8f6\n mapread 0x57781 0x85b6 0x7495f\n copy_range 0x5d3d 0x10329 0x54fac 0x7495f\n write 0x64710 0x1c2b 0x7495f\n mapread 0x64000 0x1000 0x7495f\n\non cifs with the default cache option.\n\nIt shows read-gaps on folio 0x64 failing with a short read (ie. it hits\nEOF) if the FMODE_READ check is commented out in netfs_perform_write():\n\n if (//(file->f_mode & FMODE_READ) ||\n netfs_is_cache_enabled(ctx)) {\n\nand no fscache. This was initially found with the generic/522 xfstest."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/misc.c"], "versions": [{"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "lessThan": "f706e3889ff75877ecb3abae5ad667dbc990331e", "status": "affected", "versionType": "git"}, {"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "lessThan": "5afc2d9b86bed2e4d9e1ba467790cbc793223f98", "status": "affected", "versionType": "git"}, {"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "lessThan": "5cd5207de519ef0c085f4f559adf5eefcb4c5202", "status": "affected", "versionType": "git"}, {"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "lessThan": "4543a4d737944134a1394afe797622546fbcc98a", "status": "affected", "versionType": "git"}, {"version": "e2814004138a541110d4b2dc254a8f619c2c4ce0", "status": "affected", "versionType": "git"}, {"version": "6.10.8", "lessThan": "6.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/misc.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f706e3889ff75877ecb3abae5ad667dbc990331e"}, {"url": "https://git.kernel.org/stable/c/5afc2d9b86bed2e4d9e1ba467790cbc793223f98"}, {"url": "https://git.kernel.org/stable/c/5cd5207de519ef0c085f4f559adf5eefcb4c5202"}, {"url": "https://git.kernel.org/stable/c/4543a4d737944134a1394afe797622546fbcc98a"}], "title": "netfs: Fix zeropoint update where i_size > remote_i_size", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f706e3889ff75877ecb3abae5ad667dbc990331e", "status": "affected", "version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "versionType": "git"}, {"lessThan": "5afc2d9b86bed2e4d9e1ba467790cbc793223f98", "status": "affected", "version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "versionType": "git"}, {"lessThan": "5cd5207de519ef0c085f4f559adf5eefcb4c5202", "status": "affected", "version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "versionType": "git"}, {"lessThan": "4543a4d737944134a1394afe797622546fbcc98a", "status": "affected", "version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092", "versionType": "git"}, {"status": "affected", "version": "e2814004138a541110d4b2dc254a8f619c2c4ce0", "versionType": "git"}, {"lessThan": "6.11", "status": "affected", "version": "6.10.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/netfs/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A02E8785-F168-404D-9180-1DBF7349FF28", "versionEndExcluding": "6.11", "versionStartIncluding": "6.10.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0F462A69-5D23-4583-879D-334BAD44AFC2", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.11.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*", "matchCriteriaId": "4770BA57-3F3F-493B-8608-EC3B25254949", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*", "matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*", "matchCriteriaId": "DE5298B3-04B4-4F3E-B186-01A58B5C75A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix zeropoint update where i_size > remote_i_size\n\nFix the update of the zero point[*] by netfs_release_folio() when there is\nuncommitted data in the pagecache beyond the folio being released but the\non-server EOF is in this folio (ie. i_size > remote_i_size). The update\nneeds to limit zero_point to remote_i_size, not i_size as i_size is a local\nphenomenon reflecting updates made locally to the pagecache, not stuff\nwritten to the server. remote_i_size tracks the server's i_size.\n\n[*] The zero point is the file position from which we can assume that the\n server will just return zeros, so we can avoid generating reads.\n\nNote that netfs_invalidate_folio() probably doesn't need fixing as\nzero_point should be updated by setattr after truncation or fallocate.\n\nFound with:\n\n fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\n /xfstest.test/junk --replay-ops=junk.fsxops\n\nusing the following as junk.fsxops:\n\n truncate 0x0 0x1bbae 0x82864\n write 0x3ef2e 0xf9c8 0x1bbae\n write 0x67e05 0xcb5a 0x4e8f6\n mapread 0x57781 0x85b6 0x7495f\n copy_range 0x5d3d 0x10329 0x54fac 0x7495f\n write 0x64710 0x1c2b 0x7495f\n mapread 0x64000 0x1000 0x7495f\n\non cifs with the default cache option.\n\nIt shows read-gaps on folio 0x64 failing with a short read (ie. it hits\nEOF) if the FMODE_READ check is commented out in netfs_perform_write():\n\n if (//(file->f_mode & FMODE_READ) ||\n netfs_is_cache_enabled(ctx)) {\n\nand no fscache. This was initially found with the generic/522 xfstest."}], "id": "CVE-2026-64159", "lastModified": "2026-10-21T13:19:21.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T16:17:57.913", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4543a4d737944134a1394afe797622546fbcc98a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5afc2d9b86bed2e4d9e1ba467790cbc793223f98"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5cd5207de519ef0c085f4f559adf5eefcb4c5202"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f706e3889ff75877ecb3abae5ad667dbc990331e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfs: Fix zeropoint update where i_size > remote_i_size", "id": "2502573", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502573"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Linux kernel's network file system (netfs) component. This vulnerability occurs when the local file size is larger than the size reported by the remote server, leading to an incorrect update of the 'zero point' (a file position used to optimize reads). An attacker could potentially exploit this to cause unexpected read errors, where the system expects zero-filled data but encounters an End-Of-File (EOF) prematurely."], "name": "CVE-2026-64159", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64159\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64159\nhttps://lore.kernel.org/linux-cve-announce/2026071933-CVE-2026-64159-e6bb@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cce6bfa6ca0e30af9927b0074c97fe6a92f28092,5cd5207de519ef0c085f4f559adf5eefcb4c5202)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cce6bfa6ca0e30af9927b0074c97fe6a92f28092,4543a4d737944134a1394afe797622546fbcc98a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e2814004138a541110d4b2dc254a8f619c2c4ce0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.10.8,6.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T19:15:02.985552+00:00", "updated": "2026-08-17T20:30:17.383036+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-805"]}