UBUNTU-CVE-2026-98119: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest() fails syzbot reported a null-ptr-deref below [1] following a fault injection in netfsallocsubrequest(). [0] When netfsallocsubrequest() fails, subreq is NULL. Later, netfspreparewrite() tries to initialize members of subreq(e.g., source), the issue in [1] is triggered. Let's handle the error of netfspreparewrite() properly. [0] FAULTINJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Call Trace: netfsallocsubrequest+0x116/0x3f0 netfspreparewrite+0x76/0x7b0 netfsunbufferedwrite+0x75c/0x2020 netfsunbufferedwriteiterlocked+0x7d6/0xa80 netfsunbufferedwriteiter+0x442/0x720 v9fsfilewriteiter+0xbf/0x100 vfswrite+0x6ac/0x1050 [1] KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:netfspreparewrite+0xbc/0x7b0 fs/netfs/writeissue.c:173 Call Trace: netfsunbufferedwrite+0x75c/0x2020 fs/netfs/directwrite.c:111 netfsunbufferedwriteiterlocked+0x7d6/0xa80 fs/netfs/directwrite.c:290 netfsunbufferedwriteiter+0x442/0x720 fs/netfs/directwrite.c:382 v9fsfilewriteiter+0xbf/0x100 fs/9p/vfsfile.c:409 newsyncwrite fs/readwrite.c:595 [inline]