{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-64159 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64159 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64159 and fix it if it is affected.\n\nWhat it is: CVE-2026-64159 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64159 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64159/ (Markdown: https://insights.sbomify.com/CVE-2026-64159/index.md)","id":"CVE-2026-64159","markdown":"https://insights.sbomify.com/CVE-2026-64159/index.md","name":"CVE-2026-64159","record":{"aliases":["BELL-CVE-2026-64159","DEBIAN-CVE-2026-64159","GHSA-hrh3-6x34-5fxf","UBUNTU-CVE-2026-64159"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel netfs","requires_auth":"low_privilege","summary":"A logic error in the Linux kernel netfs module allows incorrect zero-point updates, potentially leading to information disclosure via short reads.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix zeropoint update where i_size \u003e remote_i_size\n\nFix the update of the zero point[*] by netfs_release_folio() when there is\nuncommitted data in the pagecache beyond the folio being released but the\non-server EOF is in this folio (ie. i_size \u003e remote_i_size).  The update\nneeds to limit zero_point to remote_i_size, not i_size as i_size is a local\nphenomenon reflecting updates made locally to the pagecache, not stuff\nwritten to the server.  remote_i_size tracks the server's i_size.\n\n[*] The zero point is the file position from which we can assume that the\n    server will just return zeros, so we can avoid generating reads.\n\nNote that netfs_invalidate_folio() probably doesn't need fixing as\nzero_point should be updated by setattr after truncation or fallocate.\n\nFound with:\n\n    fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\n        /xfstest.test/junk --replay-ops=junk.fsxops\n\nusing the following as junk.fsxops:\n\n    truncate 0x0 0x1bbae 0x82864\n    write 0x3ef2e 0xf9c8 0x1bbae\n    write 0x67e05 0xcb5a 0x4e8f6\n    mapread 0x57781 0x85b6 0x7495f\n    copy_range 0x5d3d 0x10329 0x54fac 0x7495f\n    write 0x64710 0x1c2b 0x7495f\n    mapread 0x64000 0x1000 0x7495f\n\non cifs with the default cache option.\n\nIt shows read-gaps on folio 0x64 failing with a short read (ie. it hits\nEOF) if the FMODE_READ check is commented out in netfs_perform_write():\n\n                if (//(file-\u003ef_mode \u0026 FMODE_READ) ||\n                    netfs_is_cache_enabled(ctx)) {\n\nand no fscache.  This was initially found with the generic/522 xfstest.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"netfs: Fix zeropoint update where i_size \u003e remote_i_size","id":"CVE-2026-64159","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"netfs: Fix potential for tearing in -\u003eremote_i_size and -\u003ezero_point","id":"CVE-2026-64160"},"packages":[],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2026-64158"},"products":["Linux"],"published":"2026-07-19","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A logic error in the Linux kernel netfs module allows incorrect zero-point updates, potentially leading to information disclosure via short reads.","url":"https://insights.sbomify.com/CVE-2026-64159/"}