Linux Kernel CVE-2026-31435

Requires the target system to have a network filesystem mounted using the Linux kernel netfs layer, specifically CIFS/SMB client, NFS with fscache enabled, or CephFS. Exploitation depends on triggering a read operation against the mounted filesystem that enters the retry code path, which occurs during transient I/O errors, resource contention, or server-induced retry scenarios. User interaction (UI:R in CVSS) is required to initiate the read operation, either directly through user file access or indirectly through automated processes accessing network shares. The server must be attacker-controlled or compromised to reliably trigger the retry condition with specific timing. Default kernel configurations are vulnerable if netfs-based filesystems are in use. Limits on exploitation include: not triggerable remotely without existing filesystem mount, requires specific error conditions to enter retry path (not every read operation), and kernel crash may occur before successful information disclosure reducing repeatability.

Real-world risk is moderate despite the 8.8 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-reachable attack requiring user interaction, suggesting exploitation needs a user to trigger specific read operations against a malicious or compromised network filesystem server. EPSS score of 0.02% (4th percentile) confirms low observed exploitation likelihood. Not present in CISA KEV, indicating no confirmed active exploitation. The vulnerability requires specific conditions: a netfs-backed filesystem mount (CIFS, NFS with fscache, Ceph), a read operation that enters the retry path (typically under error conditions or resource pressure), and specific timing to hit the uninitialized pointer window. Primary impact is local kernel crash (DoS) or information disclosure from adjacent memory structures rather than remote code execution. Most concerning for environments with untrusted network filesystem servers or multi-tenant systems where local users can trigger reads from attacker-controlled shares. Linux kernel memory protections (KASLR, stack canaries) may further limit exploitability. Priority should be moderate for systems using netfs-based filesystems, low for systems without network filesystem mounts.

An attacker operating a malicious SMB or NFS server induces a client running vulnerable kernel (6.12-6.19.x or early 7.0) to mount the share and read files. The attacker crafts responses that trigger read retry conditions (e.g., intermittent I/O errors, specific timing patterns in multi-subrequest responses). During retry processing, the netfs code hits the uninitialized subreq pointer path, causing kernel memory corruption. This either crashes the client system (denial of service) or leaks adjacent kernel memory structures back through the filesystem interface, potentially exposing sensitive data like kernel pointers, credentials from other processes, or filesystem metadata. In multi-tenant cloud environments, a malicious tenant could host such a server and social-engineer or trick administrators into mounting it for data migration or backup purposes.