Linux Kernel CVE-2026-64159

Exploitation requires a local user account with low-privileged access (PR:L per CVSS) on a Linux system where a network filesystem using the netfs abstraction layer - specifically CIFS - is mounted with caching enabled (the default cache option, not cache=none). The bug is triggered when local pagecache i_size exceeds the server-reported remote_i_size, a state reached naturally by writing data locally before the server acknowledges it. The specific sequence confirmed in the description involves truncate followed by writes that expand local i_size beyond server EOF, then folio release via mapread. Systems without CIFS or other netfs-backed mounts are entirely unaffected. Remote exploitation is not possible. Systems using cache=none CIFS mounts or without any network filesystem mounts are not at risk.

CVSS 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly characterizes this as a local availability issue requiring low privilege. EPSS of 0.15% at the 5th percentile reflects very low real-world exploitation probability, consistent with the local-only attack vector and the narrow triggering conditions. The vulnerability is not in CISA KEV and no public exploit code is identified. Real-world impact is limited to environments running Linux systems with netfs-backed network filesystem mounts (CIFS in particular) using caching; systems without such mounts are entirely unaffected. The availability impact is high in the narrowly applicable scope - application I/O failures and read errors - but the attack surface is small. This is not a remotely triggerable issue. The discrepancy between the 'Information Disclosure' intelligence tag and the CVSS C:N should be noted: there is no credible confidentiality impact pathway described. Overall, this is a real but low-priority fix for most environments; elevated priority for systems running network-backed filesystems with write-heavy workloads.

A local user with low-privileged access to a Linux system mounting a CIFS share with default caching performs a sequence of truncate, write, and mmap-read operations that cause local i_size to exceed remote_i_size on a specific folio. When netfs_release_folio() runs, zero_point is set to the incorrect (larger) local i_size, causing a subsequent mapread on folio 0x64 to hit the server's EOF early, resulting in a short read that causes application-level I/O failure or data corruption errors. No public exploit code exists; the reproducer sequence is documented in the CVE description using the fsx filesystem exerciser tool.