In the Linux kernel, the following vulnerability has been resolved:
netfs: Only call folio_start_fscache() one time for each folio
If a network filesystem using netfs implements a clamp_length() function, it can set subrequest lengths smaller than a page size.
When we loop through the folios in netfs_rreq_unlock_folios() to set any folios to be written back, we need to make sure we only call folio_start_fscache() once for each folio.
Otherwise, this simple testcase:
mount -o fsc,rsize=1024,wsize=1024 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file.bin bs=4096 count=1 1+0 records in 1+0 records out 4096 bytes (4.1 kB, 4.0 KiB) copied, 0.0126359 s, 324 kB/s echo 3 > /proc/sys/vm/drop_caches cat /mnt/nfs/file.bin > /dev/null
will trigger an oops similar to the following:
page dumped because: VM_BUG_ON_FOLIO(folio_test_private_2(folio)) ------------[ cut here ]------------ kernel BUG at include/linux/netfs.h:44! ... CPU: 5 PID: 134 Comm: kworker/u16:5 Kdump: loaded Not tainted 6.4.0-rc5 ... RIP: 0010:netfs_rreq_unlock_folios+0x68e/0x730 [netfs] ... Call Trace: netfs_rreq_assess+0x497/0x660 [netfs] netfs_subreq_terminated+0x32b/0x610 [netfs] nfs_netfs_read_completion+0x14e/0x1a0 [nfs] nfs_read_completion+0x2f9/0x330 [nfs] rpc_free_task+0x72/0xa0 [sunrpc] rpc_async_release+0x46/0x70 [sunrpc] process_one_work+0x3bd/0x710 worker_thread+0x89/0x610 kthread+0x181/0x1c0 ret_from_fork+0x29/0x50
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perfUpgrade kernelUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.56-82.125Upgrade kernel-develUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade python3-perf-debuginfo | Feb 17, 2025 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 2, 2024 |
| Suse | — | Upgrade kernel-rt-vdsoUpgrade kernel-source-rtUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-default-extraUpgrade kernel-syms-rtUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade kernel-rt-extraUpgrade dtb-rockchipUpgrade kernel-default-base-rebuildUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-azureUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade dtb-exynosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-source-vanillaUpgrade dtb-amlogicUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-rtUpgrade kernel-syms-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade kernel-macrosUpgrade kernel-obs-buildUpgrade kernel-azureUpgrade kernel-rt_debugUpgrade kernel-docs-htmlUpgrade dlm-kmp-rtUpgrade kernel-kvmsmallUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-vdsoUpgrade dtb-broadcomUpgrade dtb-sprdUpgrade kernel-kvmsmall-develUpgrade dtb-renesasUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade dtb-amazonUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dtb-armUpgrade dtb-allwinnerUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade kernel-rt-livepatchUpgrade kernel-rt-develUpgrade dtb-alteraUpgrade cluster-md-kmp-rtUpgrade kernel-default-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-lgUpgrade kernel-64kb-optionalUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade dtb-apmUpgrade kernel-64kbUpgrade kernel-docsUpgrade gfs2-kmp-64kbUpgrade kernel-develUpgrade dlm-kmp-defaultUpgrade dtb-mediatekUpgrade dtb-amdUpgrade kselftests-kmp-defaultUpgrade kernel-source-azureUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade dtb-hisiliconUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-appleUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-default-livepatch-develUpgrade kernel-symsUpgrade kernel-64kb-extraUpgrade dtb-freescaleUpgrade kernel-zfcpdumpUpgrade kernel-default-optionalUpgrade kernel-debugUpgrade gfs2-kmp-azure | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub