Executive brief
A vulnerability was identified in the Linux kernel's network filesystem (netfs) layer regarding how it handles failed data read requests. When certain types of read operations (Direct I/O or single reads) failed during preparation, the system did not correctly clean up internal tracking information, potentially leading to inconsistent system states or resource management issues. This has been resolved by standardizing how the kernel queues and cancels these subrequests.
Technical details
A vulnerability in the Linux kernel's netfs subsystem stemmed from improper handling of subrequest cancellation during read preparation failures. Specifically, if a DIO or single-read subrequest failed after being added to the stream subrequests list but before being fully queued, it could leave outstanding references or be prematurely abandoned while still visible to the collector. The fix harmonizes buffered, DIO, and single-read paths to ensure subrequests are queued before preparation, uses netfs_queue_read() consistently, and ensures the NETFS_SREQ_FAILED flag is set so the collector can properly manage the lifecycle of failed requests. Affected files include fs/netfs/buffered_read.c, fs/netfs/direct_read.c, and fs/netfs/read_single.c.
Affected products
- Linux Linux Kernel 6.14, 6.18.34, 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory