PT-2026-61380 · Linux · Linux

CVE-2026-64063

·

Published

2026-07-19

·

Updated

2026-07-19

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix streaming write being overwritten
In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such folios are marked dirty but may not be marked uptodate. If a folio is entirely written by a streaming write, uptodate will be set, otherwise it will have a netfs folio struct attached to ->private recording the dirty region.
In the event that a partially written streaming write page is to be overwritten entirely by a single write(), netfs perform write() will try to copy over it, but doesn't discard the netfs folio if it succeeds; further, it doesn't correctly handle a partial copy that overwrites some of the dirty data.
Fix this by the following:
(1) If the folio is successfully overwritten, free the netfs folio struct before marking the page uptodate.
(2) If the copy to the folio partially fails, but short of the dirty data, just ignore the copy.
(3) If the copy partially fails and overwrites some of the dirty data, accept the copy, update the netfs folio struct to record the new data. If the folio is now filled, free the netfs folio and set uptodate, otherwise return a partial write.
Found with:
fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 
 /xfstest.test/junk --replay-ops=junk.fsxops
using the following as junk.fsxops:
truncate 0x0 0 0x927c0
write 0x63fb8 0x53c8 0
copy range 0xb704 0x19b9 0x24429 0x79380
write 0x2402b 0x144a2 0x90660 *
write 0x204d5 0x140a0 0x927c0 *
copy range 0x1f72c 0x137d0 0x7a906 0x927c0 *
read 0x00000 0x20000 0x9157c
read 0x20000 0x20000 0x9157c
read 0x40000 0x20000 0x9157c
read 0x60000 0x20000 0x9157c
read 0x7e1a0 0xcfb9 0x9157c
on cifs with the default cache option.
It shows folio 0x24 misbehaving if the FMODE READ check is commented out in netfs perform write():
	if (//(file->f mode & FMODE READ) ||
	  netfs is cache enabled(ctx)) {
and no fscache. This was initially found with the generic/522 xfstest.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64063

Affected Products

Linux