Executive brief
A vulnerability in the Linux kernel's network filesystem (netfs) component can cause the system to crash. This occurs when a process crashes and the system attempts to write a core dump to a specific type of network storage (9P filesystem). An attacker could potentially exploit this to cause a denial-of-service by triggering a kernel panic.
Technical details
The vulnerability is a kernel BUG (panic) triggered within fs/netfs/iterator.c. When the kernel performs unbuffered writes using ITER_KVEC iterators—such as during a core dump to a 9P filesystem via __kernel_write()—the netfs_limit_iter() function fails to recognize the iterator type. Because the function only explicitly handled ITER_FOLIOQ, ITER_BVEC, and ITER_XARRAY, it reached a default BUG() statement. The fix introduces netfs_limit_kvec() to properly handle these segment arrays. This is a local denial-of-service vulnerability requiring the ability to trigger core dumps on affected filesystems.
Affected products
- Linux Linux Kernel 6.8 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-07: other: Patch authored
- 2026-04-22: advisory: CVE published
- 2026-05-19: other: NIST analysis completed