---
id: CVE-2026-98119
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfs: break unbuffered write when netfs_alloc_subrequest() fails

  syzbot reported a null-ptr-deref below [1] following a fault injection in
  netfs_alloc_subrequest()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfs: break unbuffered write when netfs_alloc_subrequest() fails

  syzbot reported a null-ptr-deref below [1] following a fault injection in
  netfs_alloc_subrequest(). […
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 288ace2f57c9d06dd2e42bd80d03747d879a4068 <
    cf6f93b8b06acf57de62dacbe71a3b99c68656a7
  - >-
    Linux >= 288ace2f57c9d06dd2e42bd80d03747d879a4068 <
    19f246c795e940dc5f11cd5bc0cb1e81bc7b7090
  - >-
    Linux >= 288ace2f57c9d06dd2e42bd80d03747d879a4068 <
    8fb45a934661419c04a44d4cfea1e0df7dcf2805
  - Linux 6.10
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:43.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98119'
references:
  - url: 'https://git.kernel.org/stable/c/19f246c795e940dc5f11cd5bc0cb1e81bc7b7090'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8fb45a934661419c04a44d4cfea1e0df7dcf2805'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cf6f93b8b06acf57de62dacbe71a3b99c68656a7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.821Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfs: break unbuffered write when netfs_alloc_subrequest() fails

syzbot reported a null-ptr-deref below [1] following a fault injection in
netfs_alloc_subrequest(). [0]

When netfs_alloc_subrequest() fails, subreq is NULL.
Later, netfs_prepare_write() tries to initialize members of
subreq(e.g., source), the issue in [1] is triggered.

Let's handle the error of netfs_prepare_write() properly.

[0]
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
Call Trace:
 netfs_alloc_subrequest+0x116/0x3f0
 netfs_prepare_write+0x76/0x7b0
 netfs_unbuffered_write+0x75c/0x2020
 netfs_unbuffered_write_iter_locked+0x7d6/0xa80
 netfs_unbuffered_write_iter+0x442/0x720
 v9fs_file_write_iter+0xbf/0x100
 vfs_write+0x6ac/0x1050

[1]
KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]
RIP: 0010:netfs_prepare_write+0xbc/0x7b0 fs/netfs/write_issue.c:173
Call Trace:
 netfs_unbuffered_write+0x75c/0x2020 fs/netfs/direct_write.c:111
 netfs_unbuffered_write_iter_locked+0x7d6/0xa80 fs/netfs/direct_write.c:290
 netfs_unbuffered_write_iter+0x442/0x720 fs/netfs/direct_write.c:382
 v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409
 new_sync_write fs/read_write.c:595 [inline]

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.