CVE-2026-64159 netfs: Fix zeropoint update where i_size > remote_i_size

Medium 5.5 Published 19 Jul 2026 Updated 21 Oct 2026

A logic error in the Linux kernel netfs module allows incorrect zero-point updates, potentially leading to information disclosure via short reads.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-64159?

CVE-2026-64159 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix zeropoint update where i_size > remote_i_size

Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_size tracks the server's i_size.

[*] The zero point is the file position from which we can assume that the server will just return zeros, so we can avoid generating reads.

Note that netfs_invalidate_folio() probably doesn't need fixing as zero_point should be updated by setattr after truncation or fallocate.

Found with:

fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops

using the following as junk.fsxops:

truncate 0x0 0x1bbae 0x82864 write 0x3ef2e 0xf9c8 0x1bbae write 0x67e05 0xcb5a 0x4e8f6 mapread 0x57781 0x85b6 0x7495f copy_range 0x5d3d 0x10329 0x54fac 0x7495f write 0x64710 0x1c2b 0x7495f mapread 0x64000 0x1000 0x7495f

on cifs with the default cache option.

It shows read-gaps on folio 0x64 failing with a short read (ie. it hits EOF) if the FMODE_READ check is commented out in netfs_perform_write():

if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) {

and no fscache. This was initially found with the generic/522 xfstest.

Which versions are affected by CVE-2026-64159?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-64159?

Apply the vendor's patch.

Is CVE-2026-64159 being exploited?

There is no known exploitation of CVE-2026-64159 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2026-64159, DEBIAN-CVE-2026-64159, GHSA-hrh3-6x34-5fxf, UBUNTU-CVE-2026-64159.