CVE-2026-80898: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80898 is a vulnerability in the Linux kernel's netfs subsystem involving improper cleanup of the PG_private_2 page flag and its associated reference when a copy-to-cache append operation fails. Specifically, netfs_pgpriv2_copy_to_cache() marks a folio with PG_private_2 before netfs_pgpriv2_copy_folio() attempts to append it to the copy-to-cache rolling buffer; if the append fails, the flag and reference are not released, leaving the folio in an inconsistent state. The vulnerability was published on September 4, 2026, and affects Linux kernel versions starting from 6.14 up to the patched releases. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.154% (GitHub Advisory, Feedly).

The root cause is a resource management error (analogous to CWE-772: Missing Release of Resource after Effective Lifetime) in the Linux kernel's netfs layer. When netfs_pgpriv2_copy_to_cache() sets the PG_private_2 flag on a folio and the subsequent append to the rolling cache buffer fails, the error path does not clear the flag or release the associated folio reference. This results in a folio left in an inconsistent state — marked as pending cache writeback but never actually queued — leading to page reference leaks and potential folio state corruption. Exploitation requires local access to trigger netfs copy-to-cache operations under conditions that cause append failures (GitHub Advisory).

A local user with the ability to trigger netfs copy-to-cache operations can cause page reference leaks and folio state corruption in the Linux kernel. Repeated exploitation of failed append operations can lead to memory exhaustion or system instability, constituting a Denial of Service (DoS) condition. There is no evidence of confidentiality or integrity impact beyond kernel memory management disruption (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit for CVE-2026-80898, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.154% (5th percentile), indicating a low probability of exploitation in the near term. Exploitation is limited to local attackers with the ability to trigger netfs operations (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version that properly clears the PG_private_2 flag and releases folio references when copy-to-cache append operations fail. Fixed commits are available at kernel stable branches: 627826ef4208042b0470d1a3fdb729ce35471a0d, 614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e, and a81fc9266e1c5fef9ccf675a9b44b2f4ab464923. Patched stable releases include Linux 6.18.44, 7.1.8, and 7.2. As a temporary workaround where immediate patching is not possible, restrict access to netfs operations to trusted users only (GitHub Advisory, Kernel Stable Fix 1).