Skip to main content

Linux Kernel CVE-2026-64157

| EUVDEUVD-2026-45842 MEDIUM
2026-07-19 Linux GHSA-5p79-2gj5-h84m
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.3 MEDIUM

AC:H because the trigger requires the specific overlap of a partial invalidation with a streaming-write folio front; I:L added for potential dirty-region data corruption beyond the reported A:H crash impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 15:24 vuln.today
CVSS changed
Aug 17, 2026 - 15:22 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix partial invalidation of streaming-write folio

In netfs_invalidate_folio(), if the region of a partial invalidation overlaps the front (but not all) of a dirty write cached in a streaming write page (dirty, but not uptodate, with the dirty region tracked by a netfs_folio struct), the function modifies the dirty region - but incorrectly as it moves the region forward by setting the start to the start, not the end, of the invalidation region.

Fix this by setting finfo->dirty_offset to the end of the invalidation region (iend).

AnalysisAI

Incorrect dirty-region bookkeeping in the Linux kernel netfs subsystem (netfs_invalidate_folio) causes a local denial-of-service condition when streaming-write folios are partially invalidated. The bug is present in kernels from commit cce6bfa6ca0e through multiple stable branches and is fixed in 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; EPSS sits at 0.17% (6th percentile), reflecting very low real-world exploitation probability despite the kernel's ubiquitous deployment.

Technical ContextAI

The netfs subsystem (cpe:2.3:a:linux:linux) is a generic network-filesystem caching library used by filesystems such as AFS, Ceph, and NFS when layered over fscache. A 'streaming write' folio is a page that has been written but not yet read from the server - it is marked dirty but not uptodate, and a companion netfs_folio struct tracks the exact byte range (dirty_offset, dirty_len) of pending data. In netfs_invalidate_folio(), when the caller requests partial invalidation of a folio whose dirty region overlaps at the front (invalidation starts at or before dirty_offset but ends before dirty_offset+dirty_len), the function must advance dirty_offset to the end of the invalidation region (iend). The bug is a single incorrect operand: dirty_offset is set to the start of the invalidation region instead of iend, causing the kernel to believe a narrowed - but wrongly positioned - dirty window still covers already-invalidated bytes. No CWE is formally assigned, but the root cause class is an off-by-one / incorrect offset arithmetic error.

RemediationAI

Upgrade to a patched kernel release: 6.12.92, 6.18.34, 7.0.11, or 7.1 (mainline). The upstream fix commits are available at https://git.kernel.org/stable/c/f6b2569ae29b666fd15ff2848684c445ba442a39, https://git.kernel.org/stable/c/3d9601c029b934b5b6a10f99791467b10eb6b211, https://git.kernel.org/stable/c/6a3d27116be2c5fb9a03d5cf37c486ac517f3689, and https://git.kernel.org/stable/c/6d91acc7fb85d33ea58fca9b964a32a453937f4b. Ubuntu users should apply the kernel update referenced in USN-8593-1. If an immediate kernel upgrade is not feasible, a compensating control is to unmount and avoid use of network filesystems that rely on the netfs streaming-write path (such as fscache-backed NFS, AFS, or Ceph client mounts) on affected hosts; this eliminates the code path entirely but may disrupt services dependent on those mounts. There is no configuration knob to disable streaming writes independently of the filesystem mount.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Affected
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-64157 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy