CVE-2026-97610: netfs: Fix uninitialized return value in netfs_unbuffered_write()
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix uninitialized return value in netfsunbufferedwrite()
If preparation of the first subrequest fails, netfsunbufferedwrite() exits its loop before ret is initialized. The empty-iterator check can do the same.
For synchronous writes, netfsunbufferedwriteiterlocked() may then return an unrelated error instead of wreq->error. This is reachable through CIFS if cifspreparewrite() fails to reopen the file or obtain credits.
Initialize ret to 0 so the caller returns wreq->error if no data was written, or the number of bytes already written otherwise.
Found with Clang's -Wconditional-uninitialized.
Affected Software
Event History
Frequently Asked Questions
When can this issue be reached in practice?
It is reachable through CIFS when cifs_prepare_write() fails to reopen a file or obtain credits during a synchronous unbuffered write. The affected path is entered when preparation of the first subrequest fails, or when an empty iterator causes the write loop to exit before setting its return value.
What is the observable impact?
A synchronous write may return an unrelated, uninitialized error value rather than the error recorded in wreq->error. If some data was already written, the intended behavior is to return the number of bytes written; if none was written, it should return wreq->error.
How is the issue fixed?
The fix initializes the local return value to zero in netfs_unbuffered_write(). This ensures the caller returns wreq->error when no data was written, rather than an unrelated error value.