Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone If a… (CVE-2026-64064)

The Linux kernel netfs subsystem had a vulnerability where netfs_invalidate_folio() did not clear the dirty bit if all modifications to a folio were removed, leaving the folio in a dirty state without the associated netfs_folio struct. This inconsistency could cause netfs_read_folio() to call netfs_read_gaps(), which expects the netfs_folio struct to be present, leading to a kernel oops (crash). The fix involves calling folio_cancel_dirty() in netfs_invalidate_folio() when all dirty data is erased, preventing the stale dirty flag and subsequent crash. This vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and numerous specific versions listed. The issue is tracked as CVE-2026-64064 with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. The vendor advisory confirms a patch is available and recommends updating to fixed kernel versions.

The vulnerability can cause a kernel crash (availability impact) due to improper handling of dirty folios in the netfs subsystem after file truncation and mmap() reads. There is no impact on confidentiality or integrity. The CVSS score is medium (5.5), reflecting the denial-of-service potential. No known exploits are reported in the wild.

A patch is available and should be applied by updating the Linux kernel to the fixed versions as provided by the vendor. After updating, a system reboot is required. The vendor advisory notes an ABI change requiring recompilation and reinstallation of third-party kernel modules. Follow the vendor's update instructions carefully to ensure full remediation.