In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry
When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path
in netfs_unbuffered_write() unconditionally calls stream->prepare_write()
without checking if it is NULL.
Filesystems such as 9P do not set the prepare_write operation, so
stream->prepare_write remains NULL. When get_user_pages() fails with
-EFAULT and the subrequest is flagged for retry, this results in a NULL
pointer dereference at fs/netfs/direct_write.c:189.
Fix this by mirroring the pattern already used in write_retry.c: if
stream->prepare_write is NULL, skip renegotiation and directly reissue
the subrequest via netfs_reissue_write(), which handles iterator reset,
IN_PROGRESS flag, stats update and reissue internally.
References
Configurations
Configuration 1 (hide)
|
History
19 May 2026, 22:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/7a5482f5ce891decbf36f2e6fab1e9fc4a76a684 - Patch | |
| References | () https://git.kernel.org/stable/c/a4d1b4ba9754bac3efebd06f583a44a7af52c0ab - Patch | |
| References | () https://git.kernel.org/stable/c/e9075e420a1eb3b52c60f3b95893a55e77419ce8 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | CWE-476 | |
| First Time |
Linux linux Kernel
Linux |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-05-19 22:09
NVD link : CVE-2026-31437
Mitre link : CVE-2026-31437
CVE.ORG link : CVE-2026-31437
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference