CVE-2026-64160
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In the Linux kernel, a vulnerability was found in the netfs mechanism, involving potential tearing when reading and writing the ->remote_i_size and ->zero_point fields. The issue stems from insufficient synchronization, which could lead to data corruption.
Risk Assessment
The risk involves obtaining inconsistent file size or zero point values, potentially leading to data corruption during network filesystem I/O operations.
Recommendation
It is recommended to immediately update the Linux kernel to a version containing the fix, which implements a seqcount mechanism similar to i_size_read()/i_size_write() and requires holding i_lock during size updates.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted.