CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix kernel BUG in netfslimititer() for ITERKVEC iterators
When a process crashes and the kernel writes a core dump to a 9P filesystem, kernelwrite() creates an ITERKVEC iterator. This iterator reaches netfslimititer() via netfsunbufferedwrite(), which only handles ITERFOLIOQ, ITERBVEC and ITERXARRAY iterator types, hitting the BUG() for any other type.
Fix this by adding netfslimitkvec() following the same pattern as netfslimitbvec(), since both kvec and bvec are simple segment arrays with pointer and length fields. Dispatch it from netfslimititer() when the iterator type is ITERKVEC.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A process must crash while the kernel is writing its core dump to a 9P filesystem. That write path creates an ITER_KVEC iterator, which reaches netfs_limit_iter() and triggers a kernel BUG() in affected code.
What is the practical impact?
The vulnerable path can cause a kernel BUG and availability impact. The CVSS vector indicates local access and low privileges are required, with no user interaction required.
What should be done if patching cannot be applied immediately?
Avoid writing process core dumps to 9P filesystems until a patch can be deployed. The provided remediation states that patches are available.