CVE-2026-64063: netfs: Fix streaming write being overwritten

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix streaming write being overwritten

In order to avoid reading whilst writing, netfslib will allow "streaming
writes" in which dirty data is stored directly into folios without reading
them first.  Such folios are marked dirty but may not be marked uptodate.
If a folio is entirely written by a streaming write, uptodate will be set,
otherwise it will have a netfs_folio struct attached to ->private recording
the dirty region.

In the event that a partially written streaming write page is to be
overwritten entirely by a single write(), netfs_perform_write() will try to
copy over it, but doesn't discard the netfs_folio if it succeeds; further,
it doesn't correctly handle a partial copy that overwrites some of the
dirty data.

Fix this by the following:

 (1) If the folio is successfully overwritten, free the netfs_folio struct
     before marking the page uptodate.

 (2) If the copy to the folio partially fails, but short of the dirty data,
     just ignore the copy.

 (3) If the copy partially fails and overwrites some of the dirty data,
     accept the copy, update the netfs_folio struct to record the new data.
     If the folio is now filled, free the netfs_folio and set uptodate,
     otherwise return a partial write.

Found with:

	fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \
	  /xfstest.test/junk --replay-ops=junk.fsxops

using the following as junk.fsxops:

	truncate 0x0 0 0x927c0
	write 0x63fb8 0x53c8 0
	copy_range 0xb704 0x19b9 0x24429 0x79380
	write 0x2402b 0x144a2 0x90660 *
	write 0x204d5 0x140a0 0x927c0 *
	copy_range 0x1f72c 0x137d0 0x7a906 0x927c0 *
	read 0x00000 0x20000 0x9157c
	read 0x20000 0x20000 0x9157c
	read 0x40000 0x20000 0x9157c
	read 0x60000 0x20000 0x9157c
	read 0x7e1a0 0xcfb9 0x9157c

on cifs with the default cache option.

It shows folio 0x24 misbehaving if the FMODE_READ check is commented out in
netfs_perform_write():

		if (//(file->f_mode & FMODE_READ) ||
		    netfs_is_cache_enabled(ctx)) {

and no fscache.  This was initially found with the generic/522 xfstest.

The Linux kernel CVE team has assigned CVE-2026-64063 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 8f52de0077ba3bf41e5d53d67a185700f41efce7 and fixed in 6.12.92 with commit 20195925c768626dc901a4781a51e508702c88ad
	Issue introduced in 6.12 with commit 8f52de0077ba3bf41e5d53d67a185700f41efce7 and fixed in 6.18.34 with commit ef9b521212e4863814ef7dfe19889abaf55ca840
	Issue introduced in 6.12 with commit 8f52de0077ba3bf41e5d53d67a185700f41efce7 and fixed in 7.0.11 with commit cdae00e8e215d95911d95f100599e187b6560de5
	Issue introduced in 6.12 with commit 8f52de0077ba3bf41e5d53d67a185700f41efce7 and fixed in 7.1 with commit 7b4dcf1b9455a6e52ac7478b4057dbe10359576d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64063
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/netfs/buffered_write.c
	include/trace/events/netfs.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/20195925c768626dc901a4781a51e508702c88ad
	https://git.kernel.org/stable/c/ef9b521212e4863814ef7dfe19889abaf55ca840
	https://git.kernel.org/stable/c/cdae00e8e215d95911d95f100599e187b6560de5
	https://git.kernel.org/stable/c/7b4dcf1b9455a6e52ac7478b4057dbe10359576d