Skip to main content

Linux Kernel CVE-2026-64158

| EUVDEUVD-2026-45843 HIGH
2026-07-19 Linux GHSA-74f7-4jjx-chgc
High
Disputed · 7.3 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
3.6 LOW

Local low-priv access (AV:L/PR:L), a timing-dependent concurrent read/write pattern on a netfs mount (AC:H), yielding limited stale-data disclosure/inconsistency (C:L/I:L) with no availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:46 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.3 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 cve.org
HIGH 7.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix write streaming disablement if fd open O_RDWR

In netfs_perform_write(), "write streaming" (the caching of dirty data in dirty but !uptodate folios) is performed to avoid the need to read data that is just going to get immediately overwritten. However, this is/will be disabled in three circumstances: if the fd is open O_RDWR, if fscache is in use (as we need to round out the blocks for DIO) or if content encryption is enabled (again for rounding out purposes).

The idea behind disabling it if the fd is open O_RDWR is that we'd need to flush the write-streaming page before we could read the data, particularly through mmap. But netfs now fills in the gaps if ->read_folio() is called on the page, so that is unnecessary. Further, this doesn't actually work if a separate fd is open for reading.

Fix this by removing the check for O_RDWR, thereby allowing streaming writes even when we might read.

This caused a number of problems with the generic/522 xfstest, but those are now fixed.

AnalysisAI

Improper handling of write streaming in the Linux kernel's netfs subsystem (network filesystem caching layer) allows a local, low-privileged user to trigger reads of stale, dirty-but-not-uptodate page cache data on network-backed filesystems. Introduced around kernel 6.8, the flaw stems from netfs caching dirty data in folios that are not marked uptodate; concurrent reads (e.g., via mmap or a separate read-only fd) could return incorrect or stale content, an information-disclosure/integrity concern (tagged 'Information Disclosure'). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.11%, 2nd percentile), indicating negligible mass-exploitation likelihood.

Technical ContextAI

The affected component is netfs, the Linux kernel's shared read/write helper library used by network filesystems such as AFS, Ceph, 9p, CIFS/SMB and cachefiles/fscache consumers. In netfs_perform_write(), 'write streaming' caches dirty data in folios that are dirty but !uptodate to avoid reading blocks that will be immediately overwritten. Streaming is disabled in three cases: fd opened O_RDWR, fscache in use (to round out blocks for DIO), or content encryption enabled. The O_RDWR disablement existed to avoid returning unflushed streaming pages to readers via mmap, but that logic is both unnecessary (netfs now fills gaps when ->read_folio() is invoked) and ineffective (a separate read-only fd bypasses it). The upstream patch removes the O_RDWR check. The root cause class is stale/inconsistent cached data exposure via page cache state (folio uptodate tracking); no CWE was assigned by the source (CWE: N/A). CPE data identifies only the generic 'cpe:2.3:a:linux:linux' product, so exact affected filesystem drivers are not enumerated.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.92, 6.18.34, 7.0.11, 7.1 or later - or apply your distribution's backport of the netfs write-streaming fix (stable commits 9adf8e47, 616578e4, 7a9fa5b0, 70a7b919 at https://git.kernel.org/stable/c/9adf8e47d73d5e3c2fe77dea649dcde350ccd65c and the companion links). Because the fix is a correctness change in netfs, there is no clean feature toggle; as a compensating control on unpatched systems you can avoid the affected code paths by not using netfs-backed network filesystems (AFS, Ceph, 9p, or cachefiles/fscache-enabled mounts) for concurrent read/write workloads, at the cost of losing those filesystems' functionality. Restricting local shell access to trusted users reduces exposure since exploitation is local. Track the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-64158.

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64158 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy