CVE-2026-31437 netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry
A local attacker can cause a kernel crash by triggering a retry path in the netfs subsystem when using filesystems like 9P that lack specific write handlers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31437?
CVE-2026-31437 is a medium-severity vulnerability in Linux kernel, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry
When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path in netfs_unbuffered_write() unconditionally calls stream->prepare_write() without checking if it is NULL.
Filesystems such as 9P do not set the prepare_write operation, so stream->prepare_write remains NULL. When get_user_pages() fails with -EFAULT and the subrequest is flagged for retry, this results in a NULL pointer dereference at fs/netfs/direct_write.c:189.
Fix this by mirroring the pattern already used in write_retry.c: if stream->prepare_write is NULL, skip renegotiation and directly reissue the subrequest via netfs_reissue_write(), which handles iterator reset, IN_PROGRESS flag, stats update and reissue internally.
Weakness: CWE-476
Which versions are affected by CVE-2026-31437?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31437?
Apply the vendor's patch.
Is CVE-2026-31437 being exploited?
There is no known exploitation of CVE-2026-31437 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31437, DEBIAN-CVE-2026-31437, GHSA-h3hr-9qqw-cvg3, UBUNTU-CVE-2026-31437.