Junglewise Threat Intelligence

CVE-2026-31438: Linux Kernel denial of service in netfs_limit_iter

CVE-2026-31438 · Severity: medium · CVSS 5.5 · Published 2026-04-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's network filesystem (netfs) component can cause the system to crash. This occurs when a process crashes and the system attempts to write a core dump to a specific type of network storage (9P filesystem). An attacker could potentially exploit this to cause a denial-of-service by triggering a kernel panic.

Technical details

The vulnerability is a kernel BUG (panic) triggered within fs/netfs/iterator.c. When the kernel performs unbuffered writes using ITER_KVEC iterators—such as during a core dump to a 9P filesystem via __kernel_write()—the netfs_limit_iter() function fails to recognize the iterator type. Because the function only explicitly handled ITER_FOLIOQ, ITER_BVEC, and ITER_XARRAY, it reached a default BUG() statement. The fix introduces netfs_limit_kvec() to properly handle these segment arrays. This is a local denial-of-service vulnerability requiring the ability to trigger core dumps on affected filesystems.

Affected products

  • Linux Linux Kernel 6.8 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc6

Timeline

  • 2026-03-07: other: Patch authored
  • 2026-04-22: advisory: CVE published
  • 2026-05-19: other: NIST analysis completed

References

Related threats