{"id":29272,"date":"2026-09-25T20:32:18","date_gmt":"2026-09-25T12:32:18","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98118"},"modified":"2026-09-25T20:32:18","modified_gmt":"2026-09-25T12:32:18","slug":"cve-2026-98118","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98118","title":{"rendered":"CVE-2026-98118 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix readahead"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfs: Fix readahead synchronisation issues by loading all folios upfront<\/p>\n<p>There are some synchronisation issues that derive from the app thread<br \/>\nadding more folios to the rolling buffer whilst the collector thread is<br \/>\nlooking at them or trying to clear them, such as determining the setting of<br \/>\nfront_folio_order when the next folio hasn&#8217;t been added yet,<\/p>\n<p>The reason for the rolling buffer approach is that loading the buffer<br \/>\nupfront and then dropping all the refs just acquired is quite a slow<br \/>\noperation, and loading progressively allows some of the cost to be deferred<br \/>\nuntil after at least some of the I\/O is started.<\/p>\n<p>Instead, a better way is to load all the folios into the rolling buffer<br \/>\nupfront &#8211; and then drop the refs later, once the I\/O is in progress.  (Even<br \/>\nbetter would be for the refs not to be there at all.)<\/p>\n<p>Fix this by changing the rolling buffer loader to load all the folios<br \/>\nselected by the VM for readahead upfront into the folio queue.  The folio<br \/>\nqueue is allocated a batch worth at a time as we don&#8217;t know how many folios<br \/>\nare involved (the readahead_control struct, alas, has a page count, not a<br \/>\nfolio count).<\/p>\n<p>The folio refs acquired from readahead are then dropped in bulk once the<br \/>\nfirst subrequest is dispatched as it&#8217;s quite a slow operation.  The<br \/>\ncollector waits for NETFS_RREQ_NEED_PUT_RA_REFS to be cleared so that it<br \/>\ndoesn&#8217;t unlock folios before the xarray has been scanned for them.<\/p>\n<p>This simplifies the buffer handling later and isn&#8217;t noticeably slower as<br \/>\nthe xarray doesn&#8217;t need to be modified and the folios are all already<br \/>\npre-locked.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfs: Fix readahead synchronisation issues by loading all folios upfront<\/p>\n<p>There are some synchronisation issues that derive from t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29272","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}