CVE-2026-98120 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix subreq ref leak
Fix a subrequest ref leak in netfs_unbuffered_write() in the event that subreq->io_iter ends up zero length during preparation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The identified vulnerability resides within the Linux kernel's network filesystem (netfs) subsystem, specifically affecting the handling of unbuffered write operations. The core issue is a reference count leak associated with subrequests, which are fundamental data structures used to manage I/O operations across distributed or remote storage backends. In this context, a subrequest represents an individual unit of work that needs to be processed by the underlying filesystem driver. Proper lifecycle management of these objects is critical because they allocate kernel memory and may hold locks or other resources that must be released upon completion to prevent system instability.
The technical flaw occurs in the netfs_unbuffered_write function, which prepares subrequests for writing data directly from user space buffers without using page cache buffering. During the preparation phase, the code evaluates whether the amount of data to be written is valid by checking if the io_iter iterator results in a zero length. If this condition is met, indicating that no actual I/O will take place due to an empty or invalid range, the function fails to properly decrement the reference count on the subrequest object before returning. This oversight means that while the operation logically terminates early without performing any disk writes, the kernel retains a persistent pointer and incremented counter for the allocated structure.
Over time, this lack of cleanup leads to a cumulative memory leak within the kernel space. Each instance where an unbuffered write is attempted with a zero-length range increments the reference count but fails to release it. As these operations accumulate under certain workloads or specific application behaviors that trigger such edge cases, the system gradually consumes available kernel memory resources. This can eventually lead to resource exhaustion, potentially causing performance degradation for other processes sharing the same kernel memory pool or triggering out-of-memory conditions if left unchecked over extended periods.
From a classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective usage. The failure to properly manage object lifecycles is a common source of stability issues in complex systems like the Linux kernel. While not directly exploitable for remote code execution or privilege escalation in its current form due to the nature of being a resource leak rather than an arbitrary write primitive, it represents a significant reliability risk that can be leveraged for denial-of-service attacks by inducing memory exhaustion through repeated triggering of the affected code path.
Mitigation strategies primarily involve applying vendor-provided kernel patches that address this specific reference counting logic error. System administrators should ensure their systems are updated with the latest stable kernel versions where this fix has been integrated. For environments running custom or older kernels, backporting the patch to netfs_unbuffered_write is necessary to restore correct resource management behavior. Additionally, monitoring tools can be configured to track memory usage patterns in kernel space to detect early signs of such leaks before they impact system stability.