CVE-2026-64159

A flaw was found in the Linux kernel's network file system (netfs) component. This vulnerability occurs when the local file size is larger than the size reported by the remote server, leading to an incorrect update of the 'zero point' (a file position used to optimize reads). An attacker could potentially exploit this to cause unexpected read errors, where the system expects zero-filled data but encounters an End-Of-File (EOF) prematurely.

Red Hat has evaluated this vulnerability as Moderate severity because it requires local access and is limited to causing denial of service or read anomalies on network filesystems without compromising data confidentiality or system integrity. The flaw is triggered only during specific conditions where local uncommitted cache size exceeds the remote server's file size. Furthermore, earlier enterprise releases, such as Red Hat Enterprise Linux 8 and 9, lack the affected netfs zero-point logic and are not vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.