CVE-2026-98119 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
netfs: break unbuffered write when netfs_alloc_subrequest() fails
syzbot reported a null-ptr-deref below [1] following a fault injection in
netfs_alloc_subrequest(). [0]
When netfs_alloc_subrequest() fails, subreq is NULL. Later, netfs_prepare_write() tries to initialize members of subreq(e.g., source), the issue in [1] is triggered.
Let's handle the error of netfs_prepare_write() properly.
[0]
FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Call Trace: netfs_alloc_subrequest+0x116/0x3f0 netfs_prepare_write+0x76/0x7b0 netfs_unbuffered_write+0x75c/0x2020 netfs_unbuffered_write_iter_locked+0x7d6/0xa80 netfs_unbuffered_write_iter+0x442/0x720 v9fs_file_write_iter+0xbf/0x100 vfs_write+0x6ac/0x1050
[1]
KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]
RIP: 0010:netfs_prepare_write+0xbc/0x7b0 fs/netfs/write_issue.c:173 Call Trace: netfs_unbuffered_write+0x75c/0x2020 fs/netfs/direct_write.c:111 netfs_unbuffered_write_iter_locked+0x7d6/0xa80 fs/netfs/direct_write.c:290 netfs_unbuffered_write_iter+0x442/0x720 fs/netfs/direct_write.c:382 v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409 new_sync_write fs/read_write.c:595 [inline]
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's network filesystem (netfs) subsystem contains a critical null pointer dereference vulnerability that arises during unbuffered write operations when memory allocation fails. This flaw is located in the interaction between netfs_alloc_subrequest and netfs_prepare_write functions within the direct write path of the file system implementation. The root cause lies in insufficient error handling for resource acquisition failures, specifically when the kernel's slab allocator returns a null pointer instead of a valid subrequest structure due to memory pressure or intentional fault injection during testing scenarios such as those triggered by syzbot.
When an application initiates an unbuffered write operation through interfaces like v9fs_file_write_iter, the netfs layer attempts to allocate a subrequest object via netfs_alloc_subrequest. This function is responsible for preparing the necessary data structures required to manage I/O operations against remote storage systems. If this allocation fails and returns NULL, subsequent code execution proceeds without verifying the validity of the returned pointer. Specifically, netfs_prepare_write assumes that subreq is a valid memory address and attempts to initialize its members, such as setting up source buffers or other internal state variables. Accessing member fields on a null pointer results in an invalid memory access, triggering a kernel panic or system crash due to the resulting segmentation fault detected by KASAN (Kernel Address Sanitizer).
The operational impact of this vulnerability is severe, primarily affecting system stability and availability rather than confidentiality or integrity directly. An attacker who can induce conditions leading to frequent allocation failures, such as exhausting available memory through resource exhaustion attacks, could cause denial of service by crashing the kernel. While direct exploitation for privilege escalation is unlikely given that null pointer dereferences typically result in oopses rather than arbitrary code execution without additional context manipulation, the reliability impact on networked file systems remains significant. Systems relying heavily on netfs-based protocols like 9P may experience intermittent instability under high load or memory-constrained environments where allocation failures are more probable.
This vulnerability maps to CWE-476: NULL Pointer Dereference in the Common Weakness Enumeration taxonomy, reflecting a failure to check for null returns from functions that can fail due to resource exhaustion. In terms of attack patterns, it aligns with MITRE ATT&CK technique T1498: Network Denial of Service, specifically under sub-techniques involving resource exhaustion or flooding, as the vulnerability is triggered by conditions that prevent successful memory allocation. The call trace indicates involvement in v9fs_file_write_iter, suggesting that systems using 9P protocol for network file sharing are particularly susceptible to this issue when subjected to stress tests or malicious write operations designed to trigger allocation failures.
Mitigation strategies involve applying kernel patches that implement proper error handling checks after calling netfs_alloc_subrequest. Developers must verify the return value before proceeding with any initialization steps in netfs_prepare_write. If the subrequest pointer is null, the function should immediately return an appropriate error code such as -ENOMEM to propagate the failure up the call stack rather than attempting to dereference invalid memory. Additionally, administrators can mitigate risk by ensuring adequate system resources are available and monitoring for signs of memory pressure that might exacerbate allocation failures in production environments until patches are deployed.