Executive brief
A synchronization issue was identified in the Linux kernel's network filesystem (netfs) library, which manages data transfers between the system and network storage. Under certain conditions when retrying failed data requests, the system failed to properly lock internal data structures, potentially leading to system instability or data corruption. This affects the reliability of network-attached storage operations on Linux systems.
Technical details
A race condition exists in the Linux kernel's netfs library within the `netfs_retry_read_subrequests()` and `netfs_retry_write_stream()` functions. The vulnerability stems from missing spinlock acquisitions when modifying the `stream->subrequests` list during I/O retry operations. An attacker or specific system workloads could trigger this concurrent access, leading to list corruption or use-after-free scenarios. The fix introduces `spin_lock(&rreq->lock)` around `list_del` and `list_add` operations in `fs/netfs/read_retry.c` and `fs/netfs/write_retry.c`. Patches are available in the stable Linux kernel tree.
Affected products
- Linux Linux Kernel 6.10 to 7.1
Timeline
- 2026-05-12: patched: Initial fix committed to kernel source
- 2026-07-19: disclosed: CVE published to NVD dataset