Vulnerability-Lookup

GHSA-23R9-PMC9-FCX4

Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-19 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call

The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%.

while true; do sudo ./check generic/013 done

[ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322 [ 9849.452412] memcg:ffff8881a1915800 [ 9849.452417] aops:ceph_aops ino:1000058db9e dentry name(?):"f9XXXXXX" [ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248 [ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800 [ 9849.452447] page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio)) [ 9849.452474] ------------[ cut here ]------------ [ 9849.452476] kernel BUG at mm/filemap.c:1504! [ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full) [ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1 0/2025 [ 9849.484539] RIP: 0010:folio_unlock+0x85/0xa0 [ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84 [ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246 [ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000 [ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000 [ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000 [ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000 [ 9849.502516] FS: 00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000 [ 9849.502996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0 [ 9849.504459] PKRU: 55555554 [ 9849.504626] Call Trace: [ 9849.505242] [ 9849.505379] netfs_write_begin+0x7c8/0x10a0 [ 9849.505877] ? __kasan_check_read+0x11/0x20 [ 9849.506384] ? __pfx_netfs_write_begin+0x10/0x10 [ 9849.507178] ceph_write_begin+0x8c/0x1c0 [ 9849.507934] generic_perform_write+0x391/0x8f0 [ 9849.508503] ? __pfx_generic_perform_write+0x10/0x10 [ 9849.509062] ? file_update_time_flags+0x19a/0x4b0 [ 9849.509581] ? ceph_get_caps+0x63/0xf0 [ 9849.510259] ? ceph_get_caps+0x63/0xf0 [ 9849.510530] ceph_write_iter+0xe79/0x1ae0 [ 9849.511282] ? __pfx_ceph_write_iter+0x10/0x10 [ 9849.511839] ? lock_acquire+0x1ad/0x310 [ 9849.512334] ? ksys_write+0xf9/0x230 [ 9849.512582] ? lock_is_held_type+0xaa/0x140 [ 9849.513128] vfs_write+0x512/0x1110 [ 9849.513634] ? __fget_files+0x33/0x350 [ 9849.513893] ? __pfx_vfs_write+0x10/0x10 [ 9849.514143] ? mutex_lock_nested+0x1b/0x30 [ 9849.514394] ksys_write+0xf9/0x230 [ 9849.514621] ? __pfx_ksys_write+0x10/0x10 [ 9849.514887] ? do_syscall_64+0x25e/0x1520 [ 9849.515122] ? __kasan_check_read+0x11/0x20 [ 9849.515366] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.515655] __x64_sys_write+0x72/0xd0 [ 9849.515885] ? trace_hardirqs_on+0x24/0x1c0 [ 9849.516130] x64_sys_call+0x22f/0x2390 [ 9849.516341] do_syscall_64+0x12b/0x1520 [ 9849.516545] ? do_syscall_64+0x27c/0x1520 [ 9849.516783] ? do_syscall_64+0x27c/0x1520 [ 9849.517003] ? lock_release+0x318/0x480 [ 9849.517220] ? __x64_sys_io_getevents+0x143/0x2d0 [ 9849.517479] ? percpu_ref_put_many.constprop.0+0x8f/0x210 [ 9849.517779] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 9849.518073] ? do_syscall_64+0x25e/0x1520 [ 9849.518291] ? __kasan_check_read+0x11/0x20 [ 9849.518519] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.518799] ? do_syscall_64+0x27c/0x1520 [ 9 ---truncated---

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64065"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T16:17:47Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call\n\nThe multiple runs of generic/013 test-case is capable\nto reproduce a kernel BUG at mm/filemap.c:1504 with\nprobability of 30%.\n\nwhile true; do\n  sudo ./check generic/013\ndone\n\n[ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322\n[ 9849.452412] memcg:ffff8881a1915800\n[ 9849.452417] aops:ceph_aops ino:1000058db9e dentry name(?):\"f9XXXXXX\"\n[ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\n[ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248\n[ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800\n[ 9849.452447] page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n[ 9849.452474] ------------[ cut here ]------------\n[ 9849.452476] kernel BUG at mm/filemap.c:1504!\n[ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full)\n[ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1\n0/2025\n[ 9849.484539] RIP: 0010:folio_unlock+0x85/0xa0\n[ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc\ncc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 \u003c0f\u003e 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84\n[ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246\n[ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000\n[ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000\n[ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000\n[ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000\n[ 9849.502516] FS:  00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000\n[ 9849.502996] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0\n[ 9849.504459] PKRU: 55555554\n[ 9849.504626] Call Trace:\n[ 9849.505242]  \u003cTASK\u003e\n[ 9849.505379]  netfs_write_begin+0x7c8/0x10a0\n[ 9849.505877]  ? __kasan_check_read+0x11/0x20\n[ 9849.506384]  ? __pfx_netfs_write_begin+0x10/0x10\n[ 9849.507178]  ceph_write_begin+0x8c/0x1c0\n[ 9849.507934]  generic_perform_write+0x391/0x8f0\n[ 9849.508503]  ? __pfx_generic_perform_write+0x10/0x10\n[ 9849.509062]  ? file_update_time_flags+0x19a/0x4b0\n[ 9849.509581]  ? ceph_get_caps+0x63/0xf0\n[ 9849.510259]  ? ceph_get_caps+0x63/0xf0\n[ 9849.510530]  ceph_write_iter+0xe79/0x1ae0\n[ 9849.511282]  ? __pfx_ceph_write_iter+0x10/0x10\n[ 9849.511839]  ? lock_acquire+0x1ad/0x310\n[ 9849.512334]  ? ksys_write+0xf9/0x230\n[ 9849.512582]  ? lock_is_held_type+0xaa/0x140\n[ 9849.513128]  vfs_write+0x512/0x1110\n[ 9849.513634]  ? __fget_files+0x33/0x350\n[ 9849.513893]  ? __pfx_vfs_write+0x10/0x10\n[ 9849.514143]  ? mutex_lock_nested+0x1b/0x30\n[ 9849.514394]  ksys_write+0xf9/0x230\n[ 9849.514621]  ? __pfx_ksys_write+0x10/0x10\n[ 9849.514887]  ? do_syscall_64+0x25e/0x1520\n[ 9849.515122]  ? __kasan_check_read+0x11/0x20\n[ 9849.515366]  ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.515655]  __x64_sys_write+0x72/0xd0\n[ 9849.515885]  ? trace_hardirqs_on+0x24/0x1c0\n[ 9849.516130]  x64_sys_call+0x22f/0x2390\n[ 9849.516341]  do_syscall_64+0x12b/0x1520\n[ 9849.516545]  ? do_syscall_64+0x27c/0x1520\n[ 9849.516783]  ? do_syscall_64+0x27c/0x1520\n[ 9849.517003]  ? lock_release+0x318/0x480\n[ 9849.517220]  ? __x64_sys_io_getevents+0x143/0x2d0\n[ 9849.517479]  ? percpu_ref_put_many.constprop.0+0x8f/0x210\n[ 9849.517779]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 9849.518073]  ? do_syscall_64+0x25e/0x1520\n[ 9849.518291]  ? __kasan_check_read+0x11/0x20\n[ 9849.518519]  ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.518799]  ? do_syscall_64+0x27c/0x1520\n[ 9\n---truncated---",
  "id": "GHSA-23r9-pmc9-fcx4",
  "modified": "2026-07-19T18:31:51Z",
  "published": "2026-07-19T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64065"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51ffb788f074c0a61953086f49008028c1e7b645"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5ad05b6f5df296ef046589f222bb2587495b991e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b63971238beb79cf701dac33c6cefc56c07c89fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dc7832d05deb4d632e8035e3299e31a3528fa0d0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-64065 (GCVE-0-2026-64065)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-07-19 15:39

Title

netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call

Summary

In the Linux kernel, the following vulnerability has been resolved: netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%. while true; do sudo ./check generic/013 done [ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322 [ 9849.452412] memcg:ffff8881a1915800 [ 9849.452417] aops:ceph_aops ino:1000058db9e dentry name(?):"f9XXXXXX" [ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248 [ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800 [ 9849.452447] page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio)) [ 9849.452474] ------------[ cut here ]------------ [ 9849.452476] kernel BUG at mm/filemap.c:1504! [ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full) [ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1 0/2025 [ 9849.484539] RIP: 0010:folio_unlock+0x85/0xa0 [ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84 [ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246 [ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000 [ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000 [ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000 [ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000 [ 9849.502516] FS: 00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000 [ 9849.502996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0 [ 9849.504459] PKRU: 55555554 [ 9849.504626] Call Trace: [ 9849.505242] <TASK> [ 9849.505379] netfs_write_begin+0x7c8/0x10a0 [ 9849.505877] ? __kasan_check_read+0x11/0x20 [ 9849.506384] ? __pfx_netfs_write_begin+0x10/0x10 [ 9849.507178] ceph_write_begin+0x8c/0x1c0 [ 9849.507934] generic_perform_write+0x391/0x8f0 [ 9849.508503] ? __pfx_generic_perform_write+0x10/0x10 [ 9849.509062] ? file_update_time_flags+0x19a/0x4b0 [ 9849.509581] ? ceph_get_caps+0x63/0xf0 [ 9849.510259] ? ceph_get_caps+0x63/0xf0 [ 9849.510530] ceph_write_iter+0xe79/0x1ae0 [ 9849.511282] ? __pfx_ceph_write_iter+0x10/0x10 [ 9849.511839] ? lock_acquire+0x1ad/0x310 [ 9849.512334] ? ksys_write+0xf9/0x230 [ 9849.512582] ? lock_is_held_type+0xaa/0x140 [ 9849.513128] vfs_write+0x512/0x1110 [ 9849.513634] ? __fget_files+0x33/0x350 [ 9849.513893] ? __pfx_vfs_write+0x10/0x10 [ 9849.514143] ? mutex_lock_nested+0x1b/0x30 [ 9849.514394] ksys_write+0xf9/0x230 [ 9849.514621] ? __pfx_ksys_write+0x10/0x10 [ 9849.514887] ? do_syscall_64+0x25e/0x1520 [ 9849.515122] ? __kasan_check_read+0x11/0x20 [ 9849.515366] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.515655] __x64_sys_write+0x72/0xd0 [ 9849.515885] ? trace_hardirqs_on+0x24/0x1c0 [ 9849.516130] x64_sys_call+0x22f/0x2390 [ 9849.516341] do_syscall_64+0x12b/0x1520 [ 9849.516545] ? do_syscall_64+0x27c/0x1520 [ 9849.516783] ? do_syscall_64+0x27c/0x1520 [ 9849.517003] ? lock_release+0x318/0x480 [ 9849.517220] ? __x64_sys_io_getevents+0x143/0x2d0 [ 9849.517479] ? percpu_ref_put_many.constprop.0+0x8f/0x210 [ 9849.517779] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 9849.518073] ? do_syscall_64+0x25e/0x1520 [ 9849.518291] ? __kasan_check_read+0x11/0x20 [ 9849.518519] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.518799] ? do_syscall_64+0x27c/0x1520 [ 9 ---truncated---

Severity

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/51ffb788f074c0a61…
https://git.kernel.org/stable/c/b63971238beb79cf7…
https://git.kernel.org/stable/c/5ad05b6f5df296ef0…
https://git.kernel.org/stable/c/dc7832d05deb4d632…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ee4cdf7ba857a894ad1650d6ab77669cbbfa329e , < 51ffb788f074c0a61953086f49008028c1e7b645 (git) Affected: ee4cdf7ba857a894ad1650d6ab77669cbbfa329e , < b63971238beb79cf701dac33c6cefc56c07c89fa (git) Affected: ee4cdf7ba857a894ad1650d6ab77669cbbfa329e , < 5ad05b6f5df296ef046589f222bb2587495b991e (git) Affected: ee4cdf7ba857a894ad1650d6ab77669cbbfa329e , < dc7832d05deb4d632e8035e3299e31a3528fa0d0 (git)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/read_retry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "51ffb788f074c0a61953086f49008028c1e7b645",
              "status": "affected",
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "versionType": "git"
            },
            {
              "lessThan": "b63971238beb79cf701dac33c6cefc56c07c89fa",
              "status": "affected",
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "versionType": "git"
            },
            {
              "lessThan": "5ad05b6f5df296ef046589f222bb2587495b991e",
              "status": "affected",
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "versionType": "git"
            },
            {
              "lessThan": "dc7832d05deb4d632e8035e3299e31a3528fa0d0",
              "status": "affected",
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/read_retry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call\n\nThe multiple runs of generic/013 test-case is capable\nto reproduce a kernel BUG at mm/filemap.c:1504 with\nprobability of 30%.\n\nwhile true; do\n  sudo ./check generic/013\ndone\n\n[ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322\n[ 9849.452412] memcg:ffff8881a1915800\n[ 9849.452417] aops:ceph_aops ino:1000058db9e dentry name(?):\"f9XXXXXX\"\n[ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\n[ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248\n[ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800\n[ 9849.452447] page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n[ 9849.452474] ------------[ cut here ]------------\n[ 9849.452476] kernel BUG at mm/filemap.c:1504!\n[ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full)\n[ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1\n0/2025\n[ 9849.484539] RIP: 0010:folio_unlock+0x85/0xa0\n[ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc\ncc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 \u003c0f\u003e 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84\n[ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246\n[ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000\n[ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000\n[ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000\n[ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000\n[ 9849.502516] FS:  00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000\n[ 9849.502996] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0\n[ 9849.504459] PKRU: 55555554\n[ 9849.504626] Call Trace:\n[ 9849.505242]  \u003cTASK\u003e\n[ 9849.505379]  netfs_write_begin+0x7c8/0x10a0\n[ 9849.505877]  ? __kasan_check_read+0x11/0x20\n[ 9849.506384]  ? __pfx_netfs_write_begin+0x10/0x10\n[ 9849.507178]  ceph_write_begin+0x8c/0x1c0\n[ 9849.507934]  generic_perform_write+0x391/0x8f0\n[ 9849.508503]  ? __pfx_generic_perform_write+0x10/0x10\n[ 9849.509062]  ? file_update_time_flags+0x19a/0x4b0\n[ 9849.509581]  ? ceph_get_caps+0x63/0xf0\n[ 9849.510259]  ? ceph_get_caps+0x63/0xf0\n[ 9849.510530]  ceph_write_iter+0xe79/0x1ae0\n[ 9849.511282]  ? __pfx_ceph_write_iter+0x10/0x10\n[ 9849.511839]  ? lock_acquire+0x1ad/0x310\n[ 9849.512334]  ? ksys_write+0xf9/0x230\n[ 9849.512582]  ? lock_is_held_type+0xaa/0x140\n[ 9849.513128]  vfs_write+0x512/0x1110\n[ 9849.513634]  ? __fget_files+0x33/0x350\n[ 9849.513893]  ? __pfx_vfs_write+0x10/0x10\n[ 9849.514143]  ? mutex_lock_nested+0x1b/0x30\n[ 9849.514394]  ksys_write+0xf9/0x230\n[ 9849.514621]  ? __pfx_ksys_write+0x10/0x10\n[ 9849.514887]  ? do_syscall_64+0x25e/0x1520\n[ 9849.515122]  ? __kasan_check_read+0x11/0x20\n[ 9849.515366]  ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.515655]  __x64_sys_write+0x72/0xd0\n[ 9849.515885]  ? trace_hardirqs_on+0x24/0x1c0\n[ 9849.516130]  x64_sys_call+0x22f/0x2390\n[ 9849.516341]  do_syscall_64+0x12b/0x1520\n[ 9849.516545]  ? do_syscall_64+0x27c/0x1520\n[ 9849.516783]  ? do_syscall_64+0x27c/0x1520\n[ 9849.517003]  ? lock_release+0x318/0x480\n[ 9849.517220]  ? __x64_sys_io_getevents+0x143/0x2d0\n[ 9849.517479]  ? percpu_ref_put_many.constprop.0+0x8f/0x210\n[ 9849.517779]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 9849.518073]  ? do_syscall_64+0x25e/0x1520\n[ 9849.518291]  ? __kasan_check_read+0x11/0x20\n[ 9849.518519]  ? trace_hardirqs_on_prepare+0x178/0x1c0\n[ 9849.518799]  ? do_syscall_64+0x27c/0x1520\n[ 9\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:39:43.397Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/51ffb788f074c0a61953086f49008028c1e7b645"
        },
        {
          "url": "https://git.kernel.org/stable/c/b63971238beb79cf701dac33c6cefc56c07c89fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ad05b6f5df296ef046589f222bb2587495b991e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc7832d05deb4d632e8035e3299e31a3528fa0d0"
        }
      ],
      "title": "netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64065",
    "datePublished": "2026-07-19T15:39:43.397Z",
    "dateReserved": "2026-07-19T07:54:57.030Z",
    "dateUpdated": "2026-07-19T15:39:43.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-23R9-PMC9-FCX4

CVE-2026-64065 (GCVE-0-2026-64065)

Tags

Sightings

Nomenclature