CVE-2026-74542 netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
A memory allocation failure in the Linux kernel netfs writeback path can trigger a warning and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74542?
CVE-2026-74542 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL.
This is then extended upwards and the gfp to be used for a request is stored in the netfs_io_request struct and is then used for both requests and subrequests, eliminating the sleeping loops there.
The failure caused:
folio != NULL WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919
Which versions are affected by CVE-2026-74542?
How do I fix CVE-2026-74542?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74542 being exploited?
There is no known exploitation of CVE-2026-74542 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74542, DEBIAN-CVE-2026-74542, GHSA-6qrf-jjmp-5pjw, UBUNTU-CVE-2026-74542.