# CVE-2026-64159: linux: In the Linux kernel, the following vulnerability has been resolved:  netfs: Fix zeropoint update where i_size > remot...

CVE-2026-64159 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-64159, released July 20, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-64159
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 19, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  netfs: Fix zeropoint update where i_size > remote_i_size  Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size).  The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server.  remote_i_size tracks the server's i_size.  [*] The zero point is the file position from which we can assume that the     server will just return zeros, so we can avoid generating reads.  Note that netfs_invalidate_folio() probably doesn't need fixing as zero_point should be updated by setattr after truncation or fallocate.  Found with:      fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \         /xfstest.test/junk --replay-ops=junk.fsxops  using the following as junk.fsxops:      truncate 0x0 0x1bbae 0x82864     write 0x3ef2e 0xf9c8 0x1bbae     write 0x67e05 0xcb5a 0x4e8f6     mapread 0x57781 0x85b6 0x7495f     copy_range 0x5d3d 0x10329 0x54fac 0x7495f     write 0x64710 0x1c2b 0x7495f     mapread 0x64000 0x1000 0x7495f  on cifs with the default cache option.  It shows read-gaps on folio 0x64 failing with a short read (ie. it hits EOF) if the FMODE_READ check is commented out in netfs_perform_write():                  if (//(file->f_mode & FMODE_READ) ||                     netfs_is_cache_enabled(ctx)) {  and no fscache.  This was initially found with the generic/522 xfstest.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-64159](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64159.md) | Jul 20, 2026 |
| Linux | linux Debian 14 | 7.0.12-1 | [DEBIAN-CVE-2026-64159](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64159.md) | Jul 20, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.