{
"cvss": 5.5,
"datePublished": "2026-07-19T16:17:47.053",
"dateUpdated": "2026-09-03T15:35:54.180",
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call\n\nThe multiple runs of generic/013 test-case is capable\nto reproduce a kernel BUG at mm/filemap.c:1504 with\nprobability of 30%.\n\nwhile true; do\n sudo ./check generic/013\ndone\n\n[ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322\n[ 9849.452412] memcg:ffff8881a1915800\n[ 9849.452417] aops:ceph_aops ino:1000058db9e dentry name(?):\"f9XXXXXX\"\n[ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\n[ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248\n[ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800\n[ 9849.452447] page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n[ 9849.452474] ------------[ cut here ]------------\n[ 9849.452476] kernel BUG at mm/filemap.c:1504!\n[ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full)\n[ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1\n0/2025\n[ 9849.484539] RIP: 0010:folio_unlock+0x85/0xa0\n[ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc\ncc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84\n[ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246\n[ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000\n[ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000\n[ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000\n[ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000\n[ 9849.502516] FS: 00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000\n[ 9849.502996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0\n[ 9849.504459] PKRU: 55555554\n[ 9849.504626] Call Trace:\n[ 9849.505242] <TASK>\n[ 9849.505379] netfs_write_begin+0x7c8/0x10a0\n[ 9849.505877] ? __kasan_check_read+0x11/0x20\n[ 9849.506384] ? __pfx_netfs_write_begin+0x10/0x10\n[ 9849.507178] ceph_write_begin+0x8c/0x1c0\n[ 9849.507934] generic_perform_write+0x391/0x8f0\n[ 9849.508503] ? __pfx_generic_perform_write+0x10/0x10\n[ 9849.509062] ? file_update_time_flags+0x19a/0x4b0\n[ 9849.509581] ? ceph_get_caps+0x63/0xf0\n[ 9849.510259] ? ceph_get_caps+0x63/0xf0\n[ 9849.510530] ceph_write_iter+0xe79/0x1ae0\n[ 9849.511282] ? __pfx_ceph_write_iter+0x10/0x10\n[ 9849.511839] ? lock_acquire+0x1ad/0x310\n[ 9849.512334] ? ksys_write+0xf9/0x230\n[ 9849.512582] ? lock_is_held_type+0xaa/0x140\n[ 9849.513128] vfs_write+0x512/0x1110\n[ 9849.513634] ? __fget_files+0x33/0x350\n[ 9849.513893] ? __pfx_vfs_write+0x10/0x10\n[ 9849.514143] ? mutex_lock_nested+0x1b/0x30\n[ 9849.514394] ksys_write+0xf9/0x230\n[ 9849.514621] ? __pfx_ksys_write+0x10/0x10\n[ 9849.514887] ? do_syscall_64+0x25e/0x1520\n[ 9849.515122] ? __kasan_check_read+0x11/0x20\n[ 9849.515366] ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.515655] __x64_sys_write+0x72/0xd0\n[ 9849.515885] ? trace_hardirqs_on+0x24/0x1c0\n[ 9849.516130] x64_sys_call+0x22f/0x2390\n[ 9849.516341] do_syscall_64+0x12b/0x1520\n[ 9849.516545] ? do_syscall_64+0x27c/0x1520\n[ 9849.516783] ? do_syscall_64+0x27c/0x1520\n[ 9849.517003] ? lock_release+0x318/0x480\n[ 9849.517220] ? __x64_sys_io_getevents+0x143/0x2d0\n[ 9849.517479] ? percpu_ref_put_many.constprop.0+0x8f/0x210\n[ 9849.517779] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 9849.518073] ? do_syscall_64+0x25e/0x1520\n[ 9849.518291] ? __kasan_check_read+0x11/0x20\n[ 9849.518519] ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.518799] ? do_syscall_64+0x27c/0x1520\n[ 9\n---truncated---",
"id": "CVE-2026-64065",
"raw": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_retry.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51ffb788f074c0a61953086f49008028c1e7b645",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "b63971238beb79cf701dac33c6cefc56c07c89fa",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "5ad05b6f5df296ef046589f222bb2587495b991e",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "dc7832d05deb4d632e8035e3299e31a3528fa0d0",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_retry.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9574AA5E-61DC-4F38-82BC-69F89AA7593C",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call\n\nThe multiple runs of generic/013 test-case is capable\nto reproduce a kernel BUG at mm/filemap.c:1504 with\nprobability of 30%.\n\nwhile true; do\n sudo ./check generic/013\ndone\n\n[ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322\n[ 9849.452412] memcg:ffff8881a1915800\n[ 9849.452417] aops:ceph_aops ino:1000058db9e dentry name(?):\"f9XXXXXX\"\n[ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\n[ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248\n[ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800\n[ 9849.452447] page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n[ 9849.452474] ------------[ cut here ]------------\n[ 9849.452476] kernel BUG at mm/filemap.c:1504!\n[ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full)\n[ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1\n0/2025\n[ 9849.484539] RIP: 0010:folio_unlock+0x85/0xa0\n[ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc\ncc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84\n[ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246\n[ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000\n[ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000\n[ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000\n[ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000\n[ 9849.502516] FS: 00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000\n[ 9849.502996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0\n[ 9849.504459] PKRU: 55555554\n[ 9849.504626] Call Trace:\n[ 9849.505242] <TASK>\n[ 9849.505379] netfs_write_begin+0x7c8/0x10a0\n[ 9849.505877] ? __kasan_check_read+0x11/0x20\n[ 9849.506384] ? __pfx_netfs_write_begin+0x10/0x10\n[ 9849.507178] ceph_write_begin+0x8c/0x1c0\n[ 9849.507934] generic_perform_write+0x391/0x8f0\n[ 9849.508503] ? __pfx_generic_perform_write+0x10/0x10\n[ 9849.509062] ? file_update_time_flags+0x19a/0x4b0\n[ 9849.509581] ? ceph_get_caps+0x63/0xf0\n[ 9849.510259] ? ceph_get_caps+0x63/0xf0\n[ 9849.510530] ceph_write_iter+0xe79/0x1ae0\n[ 9849.511282] ? __pfx_ceph_write_iter+0x10/0x10\n[ 9849.511839] ? lock_acquire+0x1ad/0x310\n[ 9849.512334] ? ksys_write+0xf9/0x230\n[ 9849.512582] ? lock_is_held_type+0xaa/0x140\n[ 9849.513128] vfs_write+0x512/0x1110\n[ 9849.513634] ? __fget_files+0x33/0x350\n[ 9849.513893] ? __pfx_vfs_write+0x10/0x10\n[ 9849.514143] ? mutex_lock_nested+0x1b/0x30\n[ 9849.514394] ksys_write+0xf9/0x230\n[ 9849.514621] ? __pfx_ksys_write+0x10/0x10\n[ 9849.514887] ? do_syscall_64+0x25e/0x1520\n[ 9849.515122] ? __kasan_check_read+0x11/0x20\n[ 9849.515366] ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.515655] __x64_sys_write+0x72/0xd0\n[ 9849.515885] ? trace_hardirqs_on+0x24/0x1c0\n[ 9849.516130] x64_sys_call+0x22f/0x2390\n[ 9849.516341] do_syscall_64+0x12b/0x1520\n[ 9849.516545] ? do_syscall_64+0x27c/0x1520\n[ 9849.516783] ? do_syscall_64+0x27c/0x1520\n[ 9849.517003] ? lock_release+0x318/0x480\n[ 9849.517220] ? __x64_sys_io_getevents+0x143/0x2d0\n[ 9849.517479] ? percpu_ref_put_many.constprop.0+0x8f/0x210\n[ 9849.517779] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 9849.518073] ? do_syscall_64+0x25e/0x1520\n[ 9849.518291] ? __kasan_check_read+0x11/0x20\n[ 9849.518519] ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.518799] ? do_syscall_64+0x27c/0x1520\n[ 9\n---truncated---"
}
],
"id": "CVE-2026-64065",
"lastModified": "2026-09-03T15:35:54.180",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2026-07-19T16:17:47.053",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/51ffb788f074c0a61953086f49008028c1e7b645"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/5ad05b6f5df296ef046589f222bb2587495b991e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b63971238beb79cf701dac33c6cefc56c07c89fa"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/dc7832d05deb4d632e8035e3299e31a3528fa0d0"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"severity": "MEDIUM",
"source": "nvd",
"title": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: fix VM_BUG_ON_FOLIO() issue in netfs_writ..."
}