CVE-2026-98120

Undergoing Analysis Undergoing Analysis - In Progress

netfs Subrequest Reference Leak in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-26

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfs_unbuffered_write() in the event that subreq->io_iter ends up zero length during preparation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-26

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98120

EUVD

EUVD-2026-86951

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.3
linux	linux_kernel	From 6.18.17 (inc) to 6.18.53 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 7.0.1 (inc) to 7.2.7 (exc)
linux	linux_kernel	From 6.19.7 (inc) to 7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is a reference leak in the Linux kernel's netfs subsystem. It occurs in the netfs_unbuffered_write function when a subrequest's io_iter ends up with zero length during preparation, causing a failure to properly release a reference count.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfs component and involves a subrequest reference leak. Detection requires checking kernel logs for errors related to netfs_unbuffered_write or subrequest handling. Use commands like dmesg | grep netfs or journalctl -k | grep netfs to inspect kernel logs for anomalies.

Impact Analysis

The impact is likely limited to potential memory leaks in systems using the netfs subsystem. This could lead to gradual memory exhaustion over time if the affected function is called frequently, potentially causing system instability or performance degradation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue is a local kernel memory leak in the Linux netfs subsystem, which does not involve data exposure or unauthorized access that would typically impact regulatory compliance.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the netfs subrequest ref leak. If immediate patching is not possible, monitor kernel logs for related errors and restrict access to network file system operations until the update is applied.

Hi! I’m here to help you understand CVE-2026-98120. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...