CVE-2026-31435: netfs: Fix read abandonment during retry
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix read abandonment during retry
Under certain circumstances, all the remaining subrequests from a read request will get abandoned during retry. The abandonment process expects the 'subreq' variable to be set to the place to start abandonment from, but it doesn't always have a useful value (it will be uninitialised on the first pass through the loop and it may point to a deleted subrequest on later passes).
Fix the first jump to "abandon:" to set subreq to the start of the first subrequest expected to need retry (which, in this abandonment case, turned out unexpectedly to no longer have NEEDRETRY set).
Also clear the subreq pointer after discarding superfluous retryable subrequests to cause an oops if we do try to access it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For the Linux kernel vulnerability described ("netfs: Fix read abandonment during retry"), ensure the fix is applied so that read abandonment during retry no longer risks OOPS from accessing a deleted or uninitialised subrequest (set subreq to the start of the first jump to "abandon:" and clear the subreq pointer after discarding superfluous retryable).
Event History
Frequently Asked Questions
What does the supplied severity vector indicate about exploitation prerequisites?
The vector indicates network reachability, low attack complexity, no privileges required, and required user interaction. It also rates confidentiality, integrity, and availability impact as high if exploitation succeeds.
Is a fix available, and are fixed kernel versions identified?
The issue is described as resolved, and three stable kernel commit references are provided. The supplied data does not identify affected or fixed kernel version ranges.
Does the available information say whether a default kernel configuration is affected?
No. The supplied information identifies the netfs component and a read-retry condition, but does not state whether netfs is enabled or reachable in a default configuration.