CVE-2026-31437

Root

Cause

The vulnerability is a NULL pointer dereference in netfs_unbuffered_write() inside the Linux kernel's netfs subsystem. When a write subrequest is marked NETFS_SREQ_NEED_RETRY (e.g., after get_user_pages() fails with -EFAULT), the retry path unconditionally calls stream->prepare_write() without verifying that the function pointer is non-NULL. Filesystems like 9P do not set the prepare_write operation, leaving it as NULL, which leads to a crash at fs/netfs/direct_write.c:189 [1].

Exploitation

An attacker capable of triggering a write failure that results in a retry—such as causing a -EFAULT from get_user_pages()—on a filesystem that does not define prepare_write (e.g., 9P) can cause the kernel to dereference a NULL pointer. This requires local access or the ability to mount and use such a filesystem, leading to a denial of service [2].

Impact

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (Oops) or panic. This is a denial-of-service vulnerability with no privilege escalation or data corruption described in the sources.

Mitigation

The fix, already applied to the stable kernel tree, mirrors the pattern used in write_retry.c: if stream->prepare_write is NULL, the code skips the renegotiation and directly reissues the subrequest via netfs_reissue_write(), which handles iterator reset and flags properly. Users should apply the patch or update to a kernel version including the commit 7a5482f5ce89 [1][3].