Loading story…
A fifth-version, four-patch Linux kernel series has been proposed to prevent file truncation and hole-punch operations from discarding valid data beyond the requested byte range when large folios straddle an operation boundary. The flaw lies in generic page-cache partial-folio handling: if a required folio split fails but the folio is still considered discardable, trailing data can be lost. A folio-lookup race makes one loss path reachable in current filesystems.
Two additional potential data-loss paths depend on forthcoming ext4 buffered-I/O work using iomap and are not currently considered reachable. The patches had not been merged at publication, and no CVE, confirmed affected-release list, distribution backports, active exploitation, or privilege-escalation impact was reported. Kernel and filesystem teams should track the final upstream fix and test truncation, hole punching, shmem, minimum-folio-order mappings, and data preservation under memory pressure.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A four-patch v5 series was posted to the Linux Kernel Mailing List to prevent truncation and hole-punch operations from discarding valid data beyond a requested range when large folios straddle the boundary. The series addresses partial-folio handling, including a folio-lookup race reachable in current filesystems; it had not yet been merged at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Upstream Linux kernel maintainers patched three vulnerabilities reported by researchers, including two NULL pointer dereferences reachable by unprivileged users and a long-standing Btrfs memory corruption issue. **CVE-2025-40072** affects fanotify mount-namespace monitoring introduced in Linux `6.16`, where `do_fanotify_mark()` dereferenced the return value of `mnt_ns_from_dentry()` without verifying it was non-`NULL`, allowing a kernel crash and denial of service; the fix landed in `6.17.3` and `6.18-rc1`. **CVE-2025-39950** affects the TCP stack when `TCP-AO` is combined with `TCP_REPAIR`, causing `tcp_ao_finish_connect()` to dereference a `NULL` `skb` during `connect()` and crash the kernel. A third fix, **CVE-2025-40205**, addresses a potential 8-byte out-of-bounds write in Btrfs `btrfs_encode_fh()` that could occur when parent and inode root IDs differ and the function reports a smaller buffer requirement than it later writes. Kernel discussions said the flaw had effectively persisted for about 17 years, with an earlier latent memory-corruption concern in the same area dating back to 2010; the final patch corrected size calculations, added bounds validation, and was marked for stable kernels back to `3.0+`. Researchers said the Btrfs issue may be difficult to trigger in practice, but all three bugs were fixed upstream and highlighted as kernel stability and memory-safety risks.
Aug 20, 2026
Linux maintainers patched an x86 kernel defect that can silently discard rewritten user-space data under a specific combination of transparent huge pages, cgroup memory limits, `MADV_FREE`, and heavy memory-reclaim pressure. The flaw, present since Linux 6.6, occurs when `pmd_modify()` fails to retain the hardware dirty bit during certain memory-protection or NUMA-placement changes; reclaim can then treat live pages as disposable and return zero-filled data instead. The issue has caused production data loss, including reports from users of the Polars data analytics library. A one-line correction preserving the dirty state was committed on September 9 and merged via the x86 urgent tree after Linux 7.3-rc3, with backports planned for supported stable kernel series. Available reporting indicates an integrity defect rather than malicious exploitation; organizations running affected kernels should prioritize stable updates, particularly on workloads using transparent huge pages and memory-constrained cgroups.
Sep 16, 2026
**CVE-2023-52622** is an ext4 filesystem vulnerability that can prevent online resizing of filesystems created with an oversized flexible block-group (`flex_bg`) configuration. During resizing, ext4 may attempt to allocate a `new_group_data` array larger than the kernel allocator's `MAX_ORDER` limit, triggering a `WARN_ON` condition and causing the resize operation to fail. Red Hat rates the issue CVSS 3.1 **5.5** (`AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`): a local low-privileged user can cause a high availability impact without user interaction. Upstream Linux fixed the issue by limiting each resize pass to `MAX_RESIZE_BG`—16,384 block groups—and completing larger expansions over multiple iterations, potentially dispersing metadata within a `flex_bg`. Fixes are available in stable kernels 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8. Red Hat released fixes for affected RHEL 8 and RHEL 9 kernel packages through errata issued from August 2024 to May 2025; RHEL 9 `kernel-rt` remains affected, while RHEL 6 and 7 are outside support scope.
Aug 26, 2026