CVE-2026-64064

A flaw was found in the Linux kernel's netfs component. When a streaming write operation is performed, a memory page (folio) can remain marked as 'dirty' even after the associated data is removed by a file truncation. If this dirty page is subsequently accessed through a memory-mapped file (mmap()), the kernel attempts to read non-existent data, leading to a system crash (denial of service). This vulnerability can be triggered by a local user.

This vulnerability is rated as Moderate because an authenticated local attacker can trigger a kernel crash, resulting in a denial of service, without threatening confidentiality or system integrity. Triggering the flaw requires a specific sequence of operations—such as streaming writes followed by file truncation and subsequent memory-mapped reads—on network filesystem mounts utilizing netfs. Earlier Red Hat Enterprise Linux releases, including RHEL 8 and 9, are not affected as they do not include the vulnerable netfs folio-tracking code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.