CVE-2026-64160CWE-362

CVE-2026-64160

Critical · published July 19, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix potential for tearing in ->remote_i_size and ->zero_point

Fix potential tearing in using ->remote_i_size and ->zero_point by copying

i_size_read() and i_size_write() and using the same seqcount as for i_size.

We need to make sure that netfslib and the filesystems that use it always

hold i_lock whilst updating any of the sizes to prevent i_size_seqcount

from getting corrupted.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-07-19T20:17Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 5.18, < 7.0.117.0.11
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 19 JUL 15:40Z
    netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
    cvelistv5