CVE-2026-64064

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone<br /> <br /> If a streaming write is made, this will leave the relevant modified folio<br /> in a not-uptodate, but dirty state with a netfs_folio struct hung off of<br /> folio-&gt;private indicating the dirty range. Subsequently truncating the<br /> file such that the dirty data in the folio is removed, but the first part<br /> of the folio theoretically remains will cause the netfs_folio struct to be<br /> discarded... but will leave the dirty flag set.<br /> <br /> If the folio is then read via mmap(), netfs_read_folio() will see that the<br /> page is dirty and jump to netfs_read_gaps() to fill in the missing bits.<br /> netfs_read_gaps(), however, expects there to be a netfs_folio struct<br /> present and can oops because truncate removed it.<br /> <br /> Fix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the<br /> event that all the dirty data in the folio is erased (as nfs does).<br /> <br /> Also add some tracepoints to log modifications to a dirty page.<br /> <br /> This can be reproduced with something like:<br /> <br /> dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1<br /> umount /xfstest.test<br /> mount /xfstest.test<br /> xfs_io -c "w 0xbbbf 0xf96c" \<br /> -c "truncate 0xbbbf" \<br /> -c "mmap -r 0xb000 0x11000" \<br /> -c "mr 0xb000 0x11000" \<br /> /xfstest.test/foo<br /> <br /> with fscaching disabled (otherwise streaming writes are suppressed) and a<br /> change to netfs_perform_write() to disallow streaming writes if the fd is<br /> open O_RDWR:<br /> <br /> if (//(file-&gt;f_mode &amp; FMODE_READ) ||