CVE-2026-64063

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfs: Fix streaming write being overwritten<br /> <br /> In order to avoid reading whilst writing, netfslib will allow "streaming<br /> writes" in which dirty data is stored directly into folios without reading<br /> them first. Such folios are marked dirty but may not be marked uptodate.<br /> If a folio is entirely written by a streaming write, uptodate will be set,<br /> otherwise it will have a netfs_folio struct attached to -&gt;private recording<br /> the dirty region.<br /> <br /> In the event that a partially written streaming write page is to be<br /> overwritten entirely by a single write(), netfs_perform_write() will try to<br /> copy over it, but doesn&amp;#39;t discard the netfs_folio if it succeeds; further,<br /> it doesn&amp;#39;t correctly handle a partial copy that overwrites some of the<br /> dirty data.<br /> <br /> Fix this by the following:<br /> <br /> (1) If the folio is successfully overwritten, free the netfs_folio struct<br /> before marking the page uptodate.<br /> <br /> (2) If the copy to the folio partially fails, but short of the dirty data,<br /> just ignore the copy.<br /> <br /> (3) If the copy partially fails and overwrites some of the dirty data,<br /> accept the copy, update the netfs_folio struct to record the new data.<br /> If the folio is now filled, free the netfs_folio and set uptodate,<br /> otherwise return a partial write.<br /> <br /> Found with:<br /> <br /> fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \<br /> /xfstest.test/junk --replay-ops=junk.fsxops<br /> <br /> using the following as junk.fsxops:<br /> <br /> truncate 0x0 0 0x927c0<br /> write 0x63fb8 0x53c8 0<br /> copy_range 0xb704 0x19b9 0x24429 0x79380<br /> write 0x2402b 0x144a2 0x90660 *<br /> write 0x204d5 0x140a0 0x927c0 *<br /> copy_range 0x1f72c 0x137d0 0x7a906 0x927c0 *<br /> read 0x00000 0x20000 0x9157c<br /> read 0x20000 0x20000 0x9157c<br /> read 0x40000 0x20000 0x9157c<br /> read 0x60000 0x20000 0x9157c<br /> read 0x7e1a0 0xcfb9 0x9157c<br /> <br /> on cifs with the default cache option.<br /> <br /> It shows folio 0x24 misbehaving if the FMODE_READ check is commented out in<br /> netfs_perform_write():<br /> <br /> if (//(file-&gt;f_mode &amp; FMODE_READ) ||<br /> netfs_is_cache_enabled(ctx)) {<br /> <br /> and no fscache. This was initially found with the generic/522 xfstest.