Linux Kernel EUVD-2026-24762

Local access with at minimum low-privilege credentials is required (CVSS AV:L/PR:L - unauthenticated remote exploitation is not possible). The system must have a network filesystem mounted that uses the Linux netfs layer but does not implement the prepare_write stream operation; 9P (Plan 9 Filesystem Protocol, kernel module v9fs) is the explicitly named example. The vulnerability fires only when get_user_pages() fails with -EFAULT during an unbuffered write, causing NETFS_SREQ_NEED_RETRY to be set on the subrequest. Systems that do not mount 9P or equivalent filesystems are not exploitable regardless of kernel version. Exploitation is further limited by the requirement for local shell access - this is not exploitable via network services or web-facing attack surfaces.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) restricts the attack surface to local authenticated users - remote exploitation is not possible. The impact is confined to availability (kernel crash); there is no confidentiality or integrity impact, limiting the blast radius. Low attack complexity (AC:L) means the crash is reliably reproducible once the prerequisite conditions are met, but those conditions - local access plus a mounted 9P or similarly incomplete-operation filesystem - substantially narrow the exposed population. The EPSS score of 0.02% (4th percentile) is consistent with the local-only vector and the specificity of the trigger condition. The vulnerability is absent from CISA KEV and no POC has been observed. Real-world priority is low for general-purpose systems; it is elevated only in multi-tenant environments where unprivileged users have local shell access and can interact with 9P mounts (e.g., container runtimes, virtualization stacks using Plan 9 for host-guest file sharing).

An attacker with a local shell account on a system running a 9P-mounted filesystem (common in QEMU/KVM VMs using virtio-9p for host-guest sharing) initiates a write to a file on that mount while simultaneously applying memory pressure or using mmap tricks to cause get_user_pages() to return -EFAULT. The netfs retry path fires, calls the NULL stream->prepare_write pointer, and the kernel panics with a NULL pointer dereference - crashing the VM or host process. No public exploit code has been identified at time of analysis.