The Linux kernel netfs subsystem had a vulnerability where netfs_invalidate_folio() did not clear the dirty bit if all changes to a folio were removed after truncation. This left the folio in a dirty state without the netfs_folio struct, leading netfs_read_folio() to call netfs_read_gaps(), which expects the struct to be present, causing a kernel oops (crash). The issue arises after streaming writes followed by truncation and memory-mapped reads. The fix calls folio_cancel_dirty() to clear the dirty bit when all dirty data is erased, preventing the invalid state and subsequent crash.

This vulnerability can cause a kernel oops (crash) when reading a truncated file via mmap() after certain streaming write and truncate operations. This may lead to system instability or denial of service due to kernel crashes. There is no information about privilege escalation or data corruption beyond the crash.

A fix has been implemented in the Linux kernel to address this issue by properly clearing the dirty bit in netfs_invalidate_folio(). Users should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.