From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A47703A9D9F for ; Sun, 19 Jul 2026 15:46:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784476003; cv=none; b=IK2vuEoOiaVX9bWzuUEiXV59nRvpkE8ceD/6j+Q/vO5opV2X40AkbcabhXWU4f5E1eXaYgp93muDBwmxEUHs/ilT2p/wbYnauBLLTBaH80YMhoBQDp71Ay7DcSlFktUPFXKcE9OO/N0ZNd85oPFwhsDlBFW9DCT/ru/fxjRXWFk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784476003; c=relaxed/simple; bh=bsOXoFk22UBPq7cyMHfKBJvlSI8InlcYnA47AdpBj5s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eN7A2BsRIbIIzN9OxbiB29LE0drFUWoJFNM/rBAKH9VwF5SYHs6PSp+JYpYBPx5oA4B34uYMosqa+ABB+cgmfgTXrEekGEesQXA5DG+reFVXfV01pqZuOHjjnqivnBrPAYWD4s8iG0nATlrmeS01BeyQV3xoozG/x6P/gIC6bCM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tpRyMsgr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tpRyMsgr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 014B61F000E9; Sun, 19 Jul 2026 15:46:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784476002; bh=MxabyAhwBOXJ2XFEOe0owqAk16Nk9u9eomDangvKzaI=; h=From:To:Cc:Subject:Date:Reply-To; b=tpRyMsgrEZ/eCtC3PgUKL3Q8ue1AlFRQcvkc4vqIzDIdPatzbRMxFYg1WqlUcWZRD 2MR10OO0pEfiv96d6HzunmMirvv3vy8cTKqFQt5tXQBZLTnD3Gea1IS8l4DhVzTnTr lFSdRxYOMP4wxdBggGxrIprK7DIlsaaDkFOgKPSw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64159: netfs: Fix zeropoint update where i_size > remote_i_size Date: Sun, 19 Jul 2026 17:40:21 +0200 Message-ID: <2026071933-CVE-2026-64159-e6bb@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3357; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=PMNRYG/MJ8y03h5EKXjQXlORJMW2yyIybWC8JmB9oO0=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx7ysnlh5s3F/Ou+zfJdVTE1+ZRln9kX81z1eZS9iET +XaUv/VHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRyvUM82NtneJUfvXy/5KO /JD6Sl3r205jP4YF3S07CmS2803f+zTIfLd2O28Rl9kTAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: netfs: Fix zeropoint update where i_size > remote_i_size Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_size tracks the server's i_size. [*] The zero point is the file position from which we can assume that the server will just return zeros, so we can avoid generating reads. Note that netfs_invalidate_folio() probably doesn't need fixing as zero_point should be updated by setattr after truncation or fallocate. Found with: fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops using the following as junk.fsxops: truncate 0x0 0x1bbae 0x82864 write 0x3ef2e 0xf9c8 0x1bbae write 0x67e05 0xcb5a 0x4e8f6 mapread 0x57781 0x85b6 0x7495f copy_range 0x5d3d 0x10329 0x54fac 0x7495f write 0x64710 0x1c2b 0x7495f mapread 0x64000 0x1000 0x7495f on cifs with the default cache option. It shows read-gaps on folio 0x64 failing with a short read (ie. it hits EOF) if the FMODE_READ check is commented out in netfs_perform_write(): if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) { and no fscache. This was initially found with the generic/522 xfstest. The Linux kernel CVE team has assigned CVE-2026-64159 to this issue. Affected and fixed versions =========================== Issue introduced in 6.11 with commit cce6bfa6ca0e30af9927b0074c97fe6a92f28092 and fixed in 7.0.11 with commit 5cd5207de519ef0c085f4f559adf5eefcb4c5202 Issue introduced in 6.11 with commit cce6bfa6ca0e30af9927b0074c97fe6a92f28092 and fixed in 7.1 with commit 4543a4d737944134a1394afe797622546fbcc98a Issue introduced in 6.10.8 with commit e2814004138a541110d4b2dc254a8f619c2c4ce0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64159 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/netfs/misc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5cd5207de519ef0c085f4f559adf5eefcb4c5202 https://git.kernel.org/stable/c/4543a4d737944134a1394afe797622546fbcc98a