CVE-2026-98119: netfs: break unbuffered write when netfs_alloc_subrequest() fails
In the Linux kernel, the following vulnerability has been resolved:
netfs: break unbuffered write when netfsallocsubrequest() fails
syzbot reported a null-ptr-deref below [1] following a fault injection in netfsallocsubrequest(). [0]
When netfsallocsubrequest() fails, subreq is NULL. Later, netfspreparewrite() tries to initialize members of subreq(e.g., source), the issue in [1] is triggered.
Let's handle the error of netfspreparewrite() properly.
[0] FAULTINJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Call Trace: netfsallocsubrequest+0x116/0x3f0 netfspreparewrite+0x76/0x7b0 netfsunbufferedwrite+0x75c/0x2020 netfsunbufferedwriteiterlocked+0x7d6/0xa80 netfsunbufferedwriteiter+0x442/0x720 v9fsfilewriteiter+0xbf/0x100 vfswrite+0x6ac/0x1050
[1] KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:netfspreparewrite+0xbc/0x7b0 fs/netfs/writeissue.c:173 Call Trace: netfsunbufferedwrite+0x75c/0x2020 fs/netfs/directwrite.c:111 netfsunbufferedwriteiterlocked+0x7d6/0xa80 fs/netfs/directwrite.c:290 netfsunbufferedwriteiter+0x442/0x720 fs/netfs/directwrite.c:382 v9fsfilewriteiter+0xbf/0x100 fs/9p/vfsfile.c:409 newsyncwrite fs/readwrite.c:595 [inline]
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the crash?
An unbuffered write must reach the netfs write path while netfs_alloc_subrequest() fails. The reported trigger used fault injection to force that allocation failure, after which the code dereferences the resulting NULL subrequest.
Which workload is shown to reach the affected path?
The provided stack trace shows the path being reached through v9fs_file_write_iter during a write operation. The vulnerability is in the shared netfs unbuffered-write handling shown in the trace.
What is the impact of a successful trigger?
The failure can cause a kernel NULL-pointer dereference in netfs_prepare_write(), reported by KASAN. This indicates a kernel crash or denial-of-service condition.