CVE-2026-64065

In the Linux kernel, the following vulnerability has been resolved:

netfs: fix VMBUGONFOLIO() issue in netfswrite_begin() call

The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%.

while true; do sudo ./check generic/013 done

[ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322 [ 9849.452412] memcg:ffff8881a1915800 [ 9849.452417] aops:cephaops ino:1000058db9e dentry name(?):"f9XXXXXX" [ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248 [ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800 [ 9849.452447] page dumped because: VMBUGONFOLIO(!foliotestlocked(folio)) [ 9849.452474] ------------[ cut here ]------------ [ 9849.452476] kernel BUG at mm/filemap.c:1504! [ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full) [ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1 0/2025 [ 9849.484539] RIP: 0010:foliounlock+0x85/0xa0 [ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84 [ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246 [ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000 [ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000 [ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000 [ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000 [ 9849.502516] FS: 00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000 [ 9849.502996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0 [ 9849.504459] PKRU: 55555554 [ 9849.504626] Call Trace: [ 9849.505242] <TASK> [ 9849.505379] netfswrite_begin+0x7c8/0x10a0 [ 9849.505877] ? __kasancheckread+0x11/0x20 [ 9849.506384] ? __pfxnetfswritebegin+0x10/0x10 [ 9849.507178] cephwrite_begin+0x8c/0x1c0 [ 9849.507934] genericperformwrite+0x391/0x8f0 [ 9849.508503] ? __pfxgenericperformwrite+0x10/0x10 [ 9849.509062] ? fileupdatetimeflags+0x19a/0x4b0 [ 9849.509581] ? cephgetcaps+0x63/0xf0 [ 9849.510259] ? cephgetcaps+0x63/0xf0 [ 9849.510530] cephwriteiter+0xe79/0x1ae0 [ 9849.511282] ? __pfxcephwriteiter+0x10/0x10 [ 9849.511839] ? lockacquire+0x1ad/0x310 [ 9849.512334] ? ksyswrite+0xf9/0x230 [ 9849.512582] ? lockisheldtype+0xaa/0x140 [ 9849.513128] vfs_write+0x512/0x1110 [ 9849.513634] ? __fget_files+0x33/0x350 [ 9849.513893] ? __pfxvfswrite+0x10/0x10 [ 9849.514143] ? mutexlocknested+0x1b/0x30 [ 9849.514394] ksys_write+0xf9/0x230 [ 9849.514621] ? __pfxksyswrite+0x10/0x10 [ 9849.514887] ? dosyscall64+0x25e/0x1520 [ 9849.515122] ? __kasancheckread+0x11/0x20 [ 9849.515366] ? trace_hardirqsonprepare+0x178/0x1c0 [ 9849.515655] __x64syswrite+0x72/0xd0 [ 9849.515885] ? trace_hardirqson+0x24/0x1c0 [ 9849.516130] x64syscall+0x22f/0x2390 [ 9849.516341] dosyscall64+0x12b/0x1520 [ 9849.516545] ? dosyscall64+0x27c/0x1520 [ 9849.516783] ? dosyscall64+0x27c/0x1520 [ 9849.517003] ? lockrelease+0x318/0x480 [ 9849.517220] ? __x64sysiogetevents+0x143/0x2d0 [ 9849.517479] ? percpurefputmany.constprop.0+0x8f/0x210 [ 9849.517779] ? entrySYSCALL64afterhwframe+0x76/0x7e [ 9849.518073] ? dosyscall64+0x25e/0x1520 [ 9849.518291] ? _kasancheckread+0x11/0x20 [ 9849.518519] ? tracehardirqsonprepare+0x178/0x1c0 [ 9849.518799] ? dosyscall64+0x27c/0x1520 [ 9 ---truncated---