CVE-2026-97610 netfs: Fix uninitialized return value in netfs_unbuffered_write()
An uninitialized variable in the Linux kernel netfs module can cause incorrect error handling during CIFS writes, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97610?
CVE-2026-97610 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix uninitialized return value in netfs_unbuffered_write()
If preparation of the first subrequest fails, netfs_unbuffered_write() exits its loop before ret is initialized. The empty-iterator check can do the same.
For synchronous writes, netfs_unbuffered_write_iter_locked() may then return an unrelated error instead of wreq->error. This is reachable through CIFS if cifs_prepare_write() fails to reopen the file or obtain credits.
Initialize ret to 0 so the caller returns wreq->error if no data was written, or the number of bytes already written otherwise.
Found with Clang's -Wconditional-uninitialized.
Which versions are affected by CVE-2026-97610?
How do I fix CVE-2026-97610?
Apply the vendor's patch.
Is CVE-2026-97610 being exploited?
There is no known exploitation of CVE-2026-97610 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97610, DEBIAN-CVE-2026-97610, GHSA-x5p7-qjx7-h5j9, UBUNTU-CVE-2026-97610.