From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D896B13A258 for ; Sun, 19 Jul 2026 15:46:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784476001; cv=none; b=nbcI097CmTiWvFXynQphAZAoNFCHq1SAFtS+d0iAp5trROUmZPZufDzfD5hWdBngpYNe7bDbKn9CYt6o86WgKI3zktmen6Lhj18t0maVM72P1TNMAP+AncfnQlyDUaAdj5nbSiv5bUwcIW8EuysUy9s+D26ogdbGSPHWUSKPpVg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784476001; c=relaxed/simple; bh=B6tPyUmr03I0qj5d4m+N8Fji9FRwyCEo6sPpVcE6KUg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lCNm2CuC2wc6RepkPVaFRopeoSaqpcSmA0v4tMoTKAKcwszppYn9MR5kVZf5aYxfF/FNeSdI7pV/hdpCpKAGg1AomT7YrBKc63oo1lTOp+syxijKWJP9nqMcaYvWR4w4tUfJRQYBiEz2Qx8K27m+H6zd8JtQOy5FVcxLpc6CsDU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=g5cynmb7; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="g5cynmb7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 356421F000E9; Sun, 19 Jul 2026 15:46:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784475999; bh=5SeAXSUH4mQgHoSjXv9XaeFktoQ2F1XxyPrkKrE+Pc0=; h=From:To:Cc:Subject:Date:Reply-To; b=g5cynmb7exA3dYLb8r1/3qsPemz1SiSsVrV+fFgt86E5099XGVopL193N8dFUDPHz nWP739qJr2X28OKjutujuV8JQvntQCWCS3HnLO3so2M8nKSurbZ69Zk8ISO8NMF/sc cMRizncXFfaUfFmHr5JsB6gpZZuqEsTkYlaIbCe0= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR Date: Sun, 19 Jul 2026 17:40:20 +0200 Message-ID: <2026071933-CVE-2026-64158-a366@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3183; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=3mUewJvSeTuaiJkaZACsjmr1217qv0cRprJXC16/UnM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx7ysnTcw0nHnTvc56Ut0LY9WghTdmHte4mHburMe1I y/ZZi6M6IhlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJLGVimO93eQXz6qdT7We0 ikU6Z0docrktf8swP3nmVt4dsy9qufuvyH3ScNTr1EoBewA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: netfs: Fix write streaming disablement if fd open O_RDWR In netfs_perform_write(), "write streaming" (the caching of dirty data in dirty but !uptodate folios) is performed to avoid the need to read data that is just going to get immediately overwritten. However, this is/will be disabled in three circumstances: if the fd is open O_RDWR, if fscache is in use (as we need to round out the blocks for DIO) or if content encryption is enabled (again for rounding out purposes). The idea behind disabling it if the fd is open O_RDWR is that we'd need to flush the write-streaming page before we could read the data, particularly through mmap. But netfs now fills in the gaps if ->read_folio() is called on the page, so that is unnecessary. Further, this doesn't actually work if a separate fd is open for reading. Fix this by removing the check for O_RDWR, thereby allowing streaming writes even when we might read. This caused a number of problems with the generic/522 xfstest, but those are now fixed. The Linux kernel CVE team has assigned CVE-2026-64158 to this issue. Affected and fixed versions =========================== Issue introduced in 6.8 with commit c38f4e96e605f17990e871214e6ea1496bc4e65f and fixed in 6.12.92 with commit 9adf8e47d73d5e3c2fe77dea649dcde350ccd65c Issue introduced in 6.8 with commit c38f4e96e605f17990e871214e6ea1496bc4e65f and fixed in 6.18.34 with commit 616578e40dcba3f94810d841c5a52b7e3bc8ede7 Issue introduced in 6.8 with commit c38f4e96e605f17990e871214e6ea1496bc4e65f and fixed in 7.0.11 with commit 7a9fa5b020a3a40f8291a71cd44c08d931da430d Issue introduced in 6.8 with commit c38f4e96e605f17990e871214e6ea1496bc4e65f and fixed in 7.1 with commit 70a7b9193bbbfceaab5974de66834c64ccc875dd Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64158 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/netfs/buffered_write.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9adf8e47d73d5e3c2fe77dea649dcde350ccd65c https://git.kernel.org/stable/c/616578e40dcba3f94810d841c5a52b7e3bc8ede7 https://git.kernel.org/stable/c/7a9fa5b020a3a40f8291a71cd44c08d931da430d https://git.kernel.org/stable/c/70a7b9193bbbfceaab5974de66834c64ccc875dd