CVE-2026-64160 (GCVE-0-2026-64160)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4058f742105ecfcbdf99e1139e6c1f74fb8e6db9 , < 55970f238d495517edc961d55c44c772594d0969 (git)
Affected: 4058f742105ecfcbdf99e1139e6c1f74fb8e6db9 , < 2c8f4742bb76117d735f92a3932d85239b16c494 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/9p/v9fs_vfs.h",
            "fs/9p/vfs_inode.c",
            "fs/9p/vfs_inode_dotl.c",
            "fs/afs/file.c",
            "fs/afs/inode.c",
            "fs/afs/internal.h",
            "fs/afs/write.c",
            "fs/netfs/buffered_read.c",
            "fs/netfs/buffered_write.c",
            "fs/netfs/direct_write.c",
            "fs/netfs/misc.c",
            "fs/netfs/write_collect.c",
            "fs/smb/client/cifsfs.c",
            "fs/smb/client/cifssmb.c",
            "fs/smb/client/file.c",
            "fs/smb/client/inode.c",
            "fs/smb/client/readdir.c",
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/smb2pdu.c",
            "include/linux/netfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "55970f238d495517edc961d55c44c772594d0969",
              "status": "affected",
              "version": "4058f742105ecfcbdf99e1139e6c1f74fb8e6db9",
              "versionType": "git"
            },
            {
              "lessThan": "2c8f4742bb76117d735f92a3932d85239b16c494",
              "status": "affected",
              "version": "4058f742105ecfcbdf99e1139e6c1f74fb8e6db9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/9p/v9fs_vfs.h",
            "fs/9p/vfs_inode.c",
            "fs/9p/vfs_inode_dotl.c",
            "fs/afs/file.c",
            "fs/afs/inode.c",
            "fs/afs/internal.h",
            "fs/afs/write.c",
            "fs/netfs/buffered_read.c",
            "fs/netfs/buffered_write.c",
            "fs/netfs/direct_write.c",
            "fs/netfs/misc.c",
            "fs/netfs/write_collect.c",
            "fs/smb/client/cifsfs.c",
            "fs/smb/client/cifssmb.c",
            "fs/smb/client/file.c",
            "fs/smb/client/inode.c",
            "fs/smb/client/readdir.c",
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/smb2pdu.c",
            "include/linux/netfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix potential for tearing in -\u003eremote_i_size and -\u003ezero_point\n\nFix potential tearing in using -\u003eremote_i_size and -\u003ezero_point by copying\ni_size_read() and i_size_write() and using the same seqcount as for i_size.\n\nWe need to make sure that netfslib and the filesystems that use it always\nhold i_lock whilst updating any of the sizes to prevent i_size_seqcount\nfrom getting corrupted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in netfs client code (CIFS/SMB, AFS, 9p) reached when processing network filesystem protocol responses and concurrent I/O; a malicious remote server can drive attribute/size updates that race with client read/write paths.\nAC:L - The attacker controls both sides of the race by timing SMB/AFS/9p responses against concurrent local read/write/DIO operations, or by spawning parallel threads performing file I/O on the same inode.\nPR:N - A remote malicious filesystem server needs no privileges on the victim host; exploitation only requires the victim system to perform routine I/O against a mounted attacker-controlled or MITM\u0027d network share.\nUI:N - No per-attack discretionary user action is required beyond an existing CIFS/AFS/9p mount and normal automated or concurrent file access, which is typical in enterprise and embedded deployments.\nS:U - Impact is confined to the victim kernel\u0027s netfs client subsystem and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - Torn 64-bit size values produce attacker-influenceable arbitrary bounds used in read-length and EOF decisions, potentially causing out-of-bounds kernel reads or stale-cache data exposure beyond intended file ranges.\nI:H - Corrupted size metadata causes incorrect zero-filling, skipped server reads, and wrong EOF handling, enabling arbitrary modification of file content visible to applications and incorrect size metadata written back to the server.\nA:H - Unsynchronized writes can corrupt i_size_seqcount, causing i_size_read() and related readers to spin forever, producing soft lockups and denial of service for affected inodes and dependent processes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:50.187Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/55970f238d495517edc961d55c44c772594d0969"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494"
        }
      ],
      "title": "netfs: Fix potential for tearing in -\u003eremote_i_size and -\u003ezero_point",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64160",
    "datePublished": "2026-07-19T15:40:47.063Z",
    "dateReserved": "2026-07-19T07:54:57.038Z",
    "dateUpdated": "2026-08-05T12:39:50.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64160",
      "date": "2026-09-21",
      "epss": "0.00407",
      "percentile": "0.34672"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:00:05.000Z",
      "cve": "CVE-2026-64160",
      "id": "msrc_CVE-2026-64160",
      "initial_release_date": "2026-07-21T01:01:54.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfs: Fix potential for tearing in -\u003eremote_i_size and -\u003ezero_point",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64160.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/9p/v9fs_vfs.h",
                  "fs/9p/vfs_inode.c",
                  "fs/9p/vfs_inode_dotl.c",
                  "fs/afs/file.c",
                  "fs/afs/inode.c",
                  "fs/afs/internal.h",
                  "fs/afs/write.c",
                  "fs/netfs/buffered_read.c",
                  "fs/netfs/buffered_write.c",
                  "fs/netfs/direct_write.c",
                  "fs/netfs/misc.c",
                  "fs/netfs/write_collect.c",
                  "fs/smb/client/cifsfs.c",
                  "fs/smb/client/cifssmb.c",
                  "fs/smb/client/file.c",
                  "fs/smb/client/inode.c",
                  "fs/smb/client/readdir.c",
                  "fs/smb/client/smb2ops.c",
                  "fs/smb/client/smb2pdu.c",
                  "include/linux/netfs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "55970f238d495517edc961d55c44c772594d0969",
                    "status": "affected",
                    "version": "4058f742105ecfcbdf99e1139e6c1f74fb8e6db9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c8f4742bb76117d735f92a3932d85239b16c494",
                    "status": "affected",
                    "version": "4058f742105ecfcbdf99e1139e6c1f74fb8e6db9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/9p/v9fs_vfs.h",
                  "fs/9p/vfs_inode.c",
                  "fs/9p/vfs_inode_dotl.c",
                  "fs/afs/file.c",
                  "fs/afs/inode.c",
                  "fs/afs/internal.h",
                  "fs/afs/write.c",
                  "fs/netfs/buffered_read.c",
                  "fs/netfs/buffered_write.c",
                  "fs/netfs/direct_write.c",
                  "fs/netfs/misc.c",
                  "fs/netfs/write_collect.c",
                  "fs/smb/client/cifsfs.c",
                  "fs/smb/client/cifssmb.c",
                  "fs/smb/client/file.c",
                  "fs/smb/client/inode.c",
                  "fs/smb/client/readdir.c",
                  "fs/smb/client/smb2ops.c",
                  "fs/smb/client/smb2pdu.c",
                  "include/linux/netfs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0DB20DAA-322B-469E-BE32-85C48AAC7796",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix potential for tearing in -\u003eremote_i_size and -\u003ezero_point\n\nFix potential tearing in using -\u003eremote_i_size and -\u003ezero_point by copying\ni_size_read() and i_size_write() and using the same seqcount as for i_size.\n\nWe need to make sure that netfslib and the filesystems that use it always\nhold i_lock whilst updating any of the sizes to prevent i_size_seqcount\nfrom getting corrupted."
          }
        ],
        "id": "CVE-2026-64160",
        "lastModified": "2026-08-17T15:05:03.423",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:58.010",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/55970f238d495517edc961d55c44c772594d0969"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:15:29+00:00",
      "cve": "CVE-2026-64160",
      "id": "CVE-2026-64160",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfs: Fix potential for tearing in -\u003eremote_i_size and -\u003ezero_point",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64160.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:54:26Z",
      "cve": "CVE-2026-64160",
      "id": "CVE-2026-64160",
      "initial_release_date": "2026-07-21T12:58:36Z",
      "product_status:known_affected": "181",
      "product_status:known_not_affected": "193",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64160",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64160.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.