CVE-2026-98119

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfs: break unbuffered write when netfs_alloc_subrequest() fails

syzbot reported a null-ptr-deref below [1] following a fault injection in

netfs_alloc_subrequest(). [0]

When netfs_alloc_subrequest() fails, subreq is NULL.

Later, netfs_prepare_write() tries to initialize members of

subreq(e.g., source), the issue in [1] is triggered.

Let's handle the error of netfs_prepare_write() properly.

[0]

FAULT_INJECTION: forcing a failure.

name failslab, interval 1, probability 0, space 0, times 0

Call Trace:

netfs_alloc_subrequest+0x116/0x3f0

netfs_prepare_write+0x76/0x7b0

netfs_unbuffered_write+0x75c/0x2020

netfs_unbuffered_write_iter_locked+0x7d6/0xa80

netfs_unbuffered_write_iter+0x442/0x720

v9fs_file_write_iter+0xbf/0x100

vfs_write+0x6ac/0x1050

[1]

KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]

RIP: 0010:netfs_prepare_write+0xbc/0x7b0 fs/netfs/write_issue.c:173

Call Trace:

netfs_unbuffer

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References