Description
In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix readahead synchronisation issues by loading all folios upfront

There are some synchronisation issues that derive from the app thread
adding more folios to the rolling buffer whilst the collector thread is
looking at them or trying to clear them, such as determining the setting of
front_folio_order when the next folio hasn't been added yet,

The reason for the rolling buffer approach is that loading the buffer
upfront and then dropping all the refs just acquired is quite a slow
operation, and loading progressively allows some of the cost to be deferred
until after at least some of the I/O is started.

Instead, a better way is to load all the folios into the rolling buffer
upfront - and then drop the refs later, once the I/O is in progress. (Even
better would be for the refs not to be there at all.)

Fix this by changing the rolling buffer loader to load all the folios
selected by the VM for readahead upfront into the folio queue. The folio
queue is allocated a batch worth at a time as we don't know how many folios
are involved (the readahead_control struct, alas, has a page count, not a
folio count).

The folio refs acquired from readahead are then dropped in bulk once the
first subrequest is dispatched as it's quite a slow operation. The
collector waits for NETFS_RREQ_NEED_PUT_RA_REFS to be cleared so that it
doesn't unlock folios before the xarray has been scanned for them.

This simplifies the buffer handling later and isn't noticeably slower as
the xarray doesn't need to be modified and the folios are all already
pre-locked.
Published: 2026-09-25
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential race condition in netfs readahead
Action: Update Kernel
AI Analysis

Impact

The issue arises when the application thread can add folios to the rolling buffer while the collector thread is simultaneously examining or clearing that same buffer. This concurrent modification may result in incomplete or missing folio processing, leading to inconsistent readahead behavior. The patch changes the loader to bring all selected folios into the buffer upfront, thereby removing the race condition and simplifying buffer handling.

Affected Systems

All Linux kernel releases that contain the rolling buffer implementation for netfs before the commit that introduced the fix are affected. This includes any distribution that ships one of those kernel versions.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate impact, and the EPSS score of <1% shows a very low probability of exploitation in the wild. The vulnerability corresponds to CWE‑366 (Concurrent Access to Unprotected Data). It is an internal kernel race condition and is not listed in CISA's KEV catalog.

Generated by OpenCVE AI on September 30, 2026 at 13:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a kernel patch that includes commit 8c9b33945712074a85d3bdacbca036ba6b3d92c6 or a later release that contains the netfs readahead fix.
  • If a kernel upgrade cannot be performed immediately, reduce or disable netfs readahead usage and limit concurrent access patterns to mitigate the race condition.
  • Continuously monitor system logs for abnormal netfs behavior and apply the patch as soon as it becomes available.

Generated by OpenCVE AI on September 30, 2026 at 13:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-368

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-366
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 25 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-368

Fri, 25 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at them or trying to clear them, such as determining the setting of front_folio_order when the next folio hasn't been added yet, The reason for the rolling buffer approach is that loading the buffer upfront and then dropping all the refs just acquired is quite a slow operation, and loading progressively allows some of the cost to be deferred until after at least some of the I/O is started. Instead, a better way is to load all the folios into the rolling buffer upfront - and then drop the refs later, once the I/O is in progress. (Even better would be for the refs not to be there at all.) Fix this by changing the rolling buffer loader to load all the folios selected by the VM for readahead upfront into the folio queue. The folio queue is allocated a batch worth at a time as we don't know how many folios are involved (the readahead_control struct, alas, has a page count, not a folio count). The folio refs acquired from readahead are then dropped in bulk once the first subrequest is dispatched as it's quite a slow operation. The collector waits for NETFS_RREQ_NEED_PUT_RA_REFS to be cleared so that it doesn't unlock folios before the xarray has been scanned for them. This simplifies the buffer handling later and isn't noticeably slower as the xarray doesn't need to be modified and the folios are all already pre-locked.
Title netfs: Fix readahead synchronisation issues by loading all folios upfront
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:14:10.484Z

Reserved: 2026-09-25T10:25:14.317Z

Link: CVE-2026-98118

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-25T11:17:43.030

Modified: 2026-10-19T10:18:10.153

Link: CVE-2026-98118

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98118 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T13:45:16Z

Weaknesses
  • CWE-366

    Race Condition within a Thread