Incorrect calculation in Linux kernel - CVE-2026-64159
Published: July 20, 2026
Vulnerability identifier: #VU138478
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64159
CWE-ID: CWE-682
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause incorrect file reads.
The vulnerability exists due to improper handling of file size state in netfs_release_folio() when releasing a folio while uncommitted page cache data exists beyond the folio and the on-server EOF falls within that folio. A local user can trigger this condition through crafted file operations to cause incorrect file reads.
This was observed on cifs with the default cache option and no fscache.
How to mitigate CVE-2026-64159
Install security update from vendor's repository.