CVE-2026-98119

Awaiting Analysis Awaiting Analysis - Queue

Null Pointer Dereference in Linux Kernel Netfs

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfs_alloc_subrequest() fails syzbot reported a null-ptr-deref below [1] following a fault injection in netfs_alloc_subrequest(). [0] When netfs_alloc_subrequest() fails, subreq is NULL. Later, netfs_prepare_write() tries to initialize members of subreq(e.g., source), the issue in [1] is triggered. Let's handle the error of netfs_prepare_write() properly. [0] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Call Trace: netfs_alloc_subrequest+0x116/0x3f0 netfs_prepare_write+0x76/0x7b0 netfs_unbuffered_write+0x75c/0x2020 netfs_unbuffered_write_iter_locked+0x7d6/0xa80 netfs_unbuffered_write_iter+0x442/0x720 v9fs_file_write_iter+0xbf/0x100 vfs_write+0x6ac/0x1050 [1] KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:netfs_prepare_write+0xbc/0x7b0 fs/netfs/write_issue.c:173 Call Trace: netfs_unbuffered_write+0x75c/0x2020 fs/netfs/direct_write.c:111 netfs_unbuffered_write_iter_locked+0x7d6/0xa80 fs/netfs/direct_write.c:290 netfs_unbuffered_write_iter+0x442/0x720 fs/netfs/direct_write.c:382 v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409 new_sync_write fs/read_write.c:595 [inline]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98119

EUVD

EUVD-2026-86950

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel occurs when netfs_alloc_subrequest() fails, returning NULL. The code later attempts to access members of this NULL pointer in netfs_prepare_write(), causing a null-pointer dereference. This leads to a kernel crash or system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfs subsystem and may not have direct detection commands. Monitor kernel logs for null-ptr-deref errors or crashes in netfs-related operations. Check for kernel oops or panic messages involving netfs functions.

Impact Analysis

If exploited, this vulnerability could crash the system, cause data corruption, or lead to denial-of-service conditions. It primarily affects systems using the Linux kernel with network filesystem (netfs) functionality.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel null-pointer dereference issue in the netfs subsystem. Compliance impacts would depend on how the affected system is used, but the vulnerability itself is a local denial-of-service or potential data corruption risk rather than a privacy or security control failure.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a vulnerable kernel version, avoid triggering netfs operations that could lead to unbuffered writes. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-98119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70