{"id":"CVE-2026-31435","title":"netfs: Fix read abandonment during retry","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix read abandonment during retry\n\nUnder certain circumstances, all the remaining subrequests from a read\nrequest will get abandoned during retry.  The abandonme…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 3e5fd8f53b575ff2188f82071da19c977ca56c41","Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 8f2f2bd128a8d9edbc1e785760da54ada3df69b7","Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:09:13.729814Z"},"published":"2026-04-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:09:59.945Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31435","references":[{"url":"https://git.kernel.org/stable/c/3e5fd8f53b575ff2188f82071da19c977ca56c41"},{"url":"https://git.kernel.org/stable/c/8f2f2bd128a8d9edbc1e785760da54ada3df69b7"},{"url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}],"tags":["cve.org"],"epss":0.00512,"epssPercentile":0.4234,"ingestedAt":"2026-10-16T17:24:46.652Z","slug":"CVE-2026-31435","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix read abandonment during retry\n\nUnder certain circumstances, all the remaining subrequests from a read\nrequest will get abandoned during retry.  The abandonment process expects\nthe 'subreq' variable to be set to the place to start abandonment from, but\nit doesn't always have a useful value (it will be uninitialised on the\nfirst pass through the loop and it may point to a deleted subrequest on\nlater passes).\n\nFix the first jump to \"abandon:\" to set subreq to the start of the first\nsubrequest expected to need retry (which, in this abandonment case, turned\nout unexpectedly to no longer have NEED_RETRY set).\n\nAlso clear the subreq pointer after discarding superfluous retryable\nsubrequests to cause an oops if we do try to access it.\n\n## Affected\n\n- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 3e5fd8f53b575ff2188f82071da19c977ca56c41`\n- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 8f2f2bd128a8d9edbc1e785760da54ada3df69b7`\n- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 7e57523490cd2efb52b1ea97f2e0a74c0fb634cd`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}