CVE-2026-64160
A critical flaw in the Linux kernel’s netfs subsystem could allow an attacker to corrupt file size information, potentially leading to data loss or corruption. The issue was fixed by ensuring proper locking and sequence counting when updating file sizes.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, especially those running older kernel versions that lack the netfs size‑locking fix.
Real-world impact
An attacker could manipulate file size metadata, causing data corruption or loss.
Why this severity
The CVSS score of 9.8 reflects the lack of authentication or user interaction required, the high impact on confidentiality, integrity, and availability, and the critical nature of kernel‑level file system corruption.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the netfs size‑locking fix.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.