CVE-2026-64063 (GCVE-0-2026-64063)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-07-19 15:39
VLAI
Title
netfs: Fix streaming write being overwritten
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such folios are marked dirty but may not be marked uptodate. If a folio is entirely written by a streaming write, uptodate will be set, otherwise it will have a netfs_folio struct attached to ->private recording the dirty region. In the event that a partially written streaming write page is to be overwritten entirely by a single write(), netfs_perform_write() will try to copy over it, but doesn't discard the netfs_folio if it succeeds; further, it doesn't correctly handle a partial copy that overwrites some of the dirty data. Fix this by the following: (1) If the folio is successfully overwritten, free the netfs_folio struct before marking the page uptodate. (2) If the copy to the folio partially fails, but short of the dirty data, just ignore the copy. (3) If the copy partially fails and overwrites some of the dirty data, accept the copy, update the netfs_folio struct to record the new data. If the folio is now filled, free the netfs_folio and set uptodate, otherwise return a partial write. Found with: fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops using the following as junk.fsxops: truncate 0x0 0 0x927c0 write 0x63fb8 0x53c8 0 copy_range 0xb704 0x19b9 0x24429 0x79380 write 0x2402b 0x144a2 0x90660 * write 0x204d5 0x140a0 0x927c0 * copy_range 0x1f72c 0x137d0 0x7a906 0x927c0 * read 0x00000 0x20000 0x9157c read 0x20000 0x20000 0x9157c read 0x40000 0x20000 0x9157c read 0x60000 0x20000 0x9157c read 0x7e1a0 0xcfb9 0x9157c on cifs with the default cache option. It shows folio 0x24 misbehaving if the FMODE_READ check is commented out in netfs_perform_write(): if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) { and no fscache. This was initially found with the generic/522 xfstest.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8f52de0077ba3bf41e5d53d67a185700f41efce7 , < 20195925c768626dc901a4781a51e508702c88ad (git)
Affected: 8f52de0077ba3bf41e5d53d67a185700f41efce7 , < ef9b521212e4863814ef7dfe19889abaf55ca840 (git)
Affected: 8f52de0077ba3bf41e5d53d67a185700f41efce7 , < cdae00e8e215d95911d95f100599e187b6560de5 (git)
Affected: 8f52de0077ba3bf41e5d53d67a185700f41efce7 , < 7b4dcf1b9455a6e52ac7478b4057dbe10359576d (git)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/buffered_write.c",
            "include/trace/events/netfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20195925c768626dc901a4781a51e508702c88ad",
              "status": "affected",
              "version": "8f52de0077ba3bf41e5d53d67a185700f41efce7",
              "versionType": "git"
            },
            {
              "lessThan": "ef9b521212e4863814ef7dfe19889abaf55ca840",
              "status": "affected",
              "version": "8f52de0077ba3bf41e5d53d67a185700f41efce7",
              "versionType": "git"
            },
            {
              "lessThan": "cdae00e8e215d95911d95f100599e187b6560de5",
              "status": "affected",
              "version": "8f52de0077ba3bf41e5d53d67a185700f41efce7",
              "versionType": "git"
            },
            {
              "lessThan": "7b4dcf1b9455a6e52ac7478b4057dbe10359576d",
              "status": "affected",
              "version": "8f52de0077ba3bf41e5d53d67a185700f41efce7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/buffered_write.c",
            "include/trace/events/netfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix streaming write being overwritten\n\nIn order to avoid reading whilst writing, netfslib will allow \"streaming\nwrites\" in which dirty data is stored directly into folios without reading\nthem first.  Such folios are marked dirty but may not be marked uptodate.\nIf a folio is entirely written by a streaming write, uptodate will be set,\notherwise it will have a netfs_folio struct attached to -\u003eprivate recording\nthe dirty region.\n\nIn the event that a partially written streaming write page is to be\noverwritten entirely by a single write(), netfs_perform_write() will try to\ncopy over it, but doesn\u0027t discard the netfs_folio if it succeeds; further,\nit doesn\u0027t correctly handle a partial copy that overwrites some of the\ndirty data.\n\nFix this by the following:\n\n (1) If the folio is successfully overwritten, free the netfs_folio struct\n     before marking the page uptodate.\n\n (2) If the copy to the folio partially fails, but short of the dirty data,\n     just ignore the copy.\n\n (3) If the copy partially fails and overwrites some of the dirty data,\n     accept the copy, update the netfs_folio struct to record the new data.\n     If the folio is now filled, free the netfs_folio and set uptodate,\n     otherwise return a partial write.\n\nFound with:\n\n\tfsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\n\t  /xfstest.test/junk --replay-ops=junk.fsxops\n\nusing the following as junk.fsxops:\n\n\ttruncate 0x0 0 0x927c0\n\twrite 0x63fb8 0x53c8 0\n\tcopy_range 0xb704 0x19b9 0x24429 0x79380\n\twrite 0x2402b 0x144a2 0x90660 *\n\twrite 0x204d5 0x140a0 0x927c0 *\n\tcopy_range 0x1f72c 0x137d0 0x7a906 0x927c0 *\n\tread 0x00000 0x20000 0x9157c\n\tread 0x20000 0x20000 0x9157c\n\tread 0x40000 0x20000 0x9157c\n\tread 0x60000 0x20000 0x9157c\n\tread 0x7e1a0 0xcfb9 0x9157c\n\non cifs with the default cache option.\n\nIt shows folio 0x24 misbehaving if the FMODE_READ check is commented out in\nnetfs_perform_write():\n\n\t\tif (//(file-\u003ef_mode \u0026 FMODE_READ) ||\n\t\t    netfs_is_cache_enabled(ctx)) {\n\nand no fscache.  This was initially found with the generic/522 xfstest."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:39:42.123Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/20195925c768626dc901a4781a51e508702c88ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef9b521212e4863814ef7dfe19889abaf55ca840"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdae00e8e215d95911d95f100599e187b6560de5"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b4dcf1b9455a6e52ac7478b4057dbe10359576d"
        }
      ],
      "title": "netfs: Fix streaming write being overwritten",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64063",
    "datePublished": "2026-07-19T15:39:42.123Z",
    "dateReserved": "2026-07-19T07:54:57.030Z",
    "dateUpdated": "2026-07-19T15:39:42.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64063",
      "date": "2026-07-22",
      "epss": "0.00168",
      "percentile": "0.06425"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64063\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:46.820\",\"lastModified\":\"2026-07-19T16:17:46.820\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfs: Fix streaming write being overwritten\\n\\nIn order to avoid reading whilst writing, netfslib will allow \\\"streaming\\nwrites\\\" in which dirty data is stored directly into folios without reading\\nthem first.  Such folios are marked dirty but may not be marked uptodate.\\nIf a folio is entirely written by a streaming write, uptodate will be set,\\notherwise it will have a netfs_folio struct attached to -\u003eprivate recording\\nthe dirty region.\\n\\nIn the event that a partially written streaming write page is to be\\noverwritten entirely by a single write(), netfs_perform_write() will try to\\ncopy over it, but doesn\u0027t discard the netfs_folio if it succeeds; further,\\nit doesn\u0027t correctly handle a partial copy that overwrites some of the\\ndirty data.\\n\\nFix this by the following:\\n\\n (1) If the folio is successfully overwritten, free the netfs_folio struct\\n     before marking the page uptodate.\\n\\n (2) If the copy to the folio partially fails, but short of the dirty data,\\n     just ignore the copy.\\n\\n (3) If the copy partially fails and overwrites some of the dirty data,\\n     accept the copy, update the netfs_folio struct to record the new data.\\n     If the folio is now filled, free the netfs_folio and set uptodate,\\n     otherwise return a partial write.\\n\\nFound with:\\n\\n\\tfsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\\\\n\\t  /xfstest.test/junk --replay-ops=junk.fsxops\\n\\nusing the following as junk.fsxops:\\n\\n\\ttruncate 0x0 0 0x927c0\\n\\twrite 0x63fb8 0x53c8 0\\n\\tcopy_range 0xb704 0x19b9 0x24429 0x79380\\n\\twrite 0x2402b 0x144a2 0x90660 *\\n\\twrite 0x204d5 0x140a0 0x927c0 *\\n\\tcopy_range 0x1f72c 0x137d0 0x7a906 0x927c0 *\\n\\tread 0x00000 0x20000 0x9157c\\n\\tread 0x20000 0x20000 0x9157c\\n\\tread 0x40000 0x20000 0x9157c\\n\\tread 0x60000 0x20000 0x9157c\\n\\tread 0x7e1a0 0xcfb9 0x9157c\\n\\non cifs with the default cache option.\\n\\nIt shows folio 0x24 misbehaving if the FMODE_READ check is commented out in\\nnetfs_perform_write():\\n\\n\\t\\tif (//(file-\u003ef_mode \u0026 FMODE_READ) ||\\n\\t\\t    netfs_is_cache_enabled(ctx)) {\\n\\nand no fscache.  This was initially found with the generic/522 xfstest.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/netfs/buffered_write.c\",\"include/trace/events/netfs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8f52de0077ba3bf41e5d53d67a185700f41efce7\",\"lessThan\":\"20195925c768626dc901a4781a51e508702c88ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f52de0077ba3bf41e5d53d67a185700f41efce7\",\"lessThan\":\"ef9b521212e4863814ef7dfe19889abaf55ca840\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f52de0077ba3bf41e5d53d67a185700f41efce7\",\"lessThan\":\"cdae00e8e215d95911d95f100599e187b6560de5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f52de0077ba3bf41e5d53d67a185700f41efce7\",\"lessThan\":\"7b4dcf1b9455a6e52ac7478b4057dbe10359576d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/netfs/buffered_write.c\",\"include/trace/events/netfs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/20195925c768626dc901a4781a51e508702c88ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7b4dcf1b9455a6e52ac7478b4057dbe10359576d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cdae00e8e215d95911d95f100599e187b6560de5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef9b521212e4863814ef7dfe19889abaf55ca840\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T13:02:42+00:00",
      "cve": "CVE-2026-64063",
      "id": "CVE-2026-64063",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfs: Fix streaming write being overwritten",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64063.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-21T13:00:22Z",
      "cve": "CVE-2026-64063",
      "id": "CVE-2026-64063",
      "initial_release_date": "2026-07-21T13:00:22Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64063",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64063.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.