Executive brief
A vulnerability in the Linux kernel's network filesystem (netfs) layer could allow a local user to crash the system. The issue occurs when certain types of data writes fail and attempt to retry, specifically affecting systems using the 9P filesystem or similar configurations. This results in a system 'kernel panic' or crash, leading to a denial of service for all users and operations on the affected machine.
Technical details
A NULL pointer dereference exists in netfs_unbuffered_write() within the Linux kernel's netfs subsystem. The vulnerability is triggered when a write subrequest is marked for retry (NETFS_SREQ_NEED_RETRY) but the underlying filesystem (such as 9P) does not implement the 'prepare_write' operation. In this scenario, the kernel unconditionally attempts to call the NULL function pointer. This typically occurs if get_user_pages() fails with -EFAULT during a direct I/O or unbuffered write operation. An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). The issue has been resolved by adding a check for the NULL pointer and utilizing netfs_reissue_write() as a fallback.
Affected products
- Linux Linux Kernel 6.18.17 to 6.18.21, 6.19.7 to 6.19.11
Timeline
- 2026-03-07: other: Initial patch authored
- 2026-04-22: disclosed: CVE published
- 2026-05-19: advisory: NVD enrichment and analysis updated