EUVD-2026-86951
GHSA-wfvc-hqrg-ch6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
DeliveryIssue unbuffered write via netfs filesystem
-
ExploitTrigger zero-length io_iter in subreq preparation
-
ExecutionLeak subrequest reference repeatedly
-
ImpactExhaust kernel memory causing DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Requires local access with low privileges (PR:L) on a system using a netfs-based kernel filesystem (the netfs library backs kernel network filesystems). The specific trigger is an unbuffered (direct) write through netfs_unbuffered_write() where subreq->io_iter ends up zero length during subrequest preparation, which leaks the subrequest reference; repeated triggering is what produces impact. Limiting factors: exploitation is local only (not remotely reachable, AV:L), needs an authenticated/low-privileged user, and requires the affected netfs write path to actually be in use (i.e. a netfs-backed filesystem mounted and exercised with direct I/O). Impact is confined to availability (memory exhaustion / DoS); there is no confidentiality or integrity effect. |
| Impact | This is a genuinely low-to-moderate priority issue despite being in a ubiquitous codebase. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) consistently describes a local, authenticated (PR:L) denial-of-service with no confidentiality or integrity impact - fully in line with CWE-401 (missing release of memory / resource leak) and the description, which is a subrequest reference-count leak in netfs_unbuffered_write(). All exploitation signals agree that this is NOT a high-urgency case: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit was found (the only exploit-adjacent URLs are the fix commits on git.kernel.org, not PoC code). The vuln.today decision label is 'this_month', i.e. routine patching rather than act_now/emergency, which is consistent with the quantitative signals. One data conflict must be stated explicitly: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N and the CWE is a memory leak (availability only) - the tag appears mislabeled and should not drive triage; the real impact is resource exhaustion, not disclosure. Net: a legitimate stability bug worth picking up in the normal kernel update cycle, not a drop-everything emergency. |
| Exploit ScenarioDerived | A local user with at least low privileges repeatedly issues unbuffered (direct I/O) writes through a netfs-backed filesystem in a way that causes a subrequest's io_iter to become zero length during preparation, leaking a subrequest reference each time. Sustained over many operations this exhausts kernel memory and degrades or crashes the system (availability impact only). No public exploit code was identified; the only external links are the upstream fix commits, not working PoCs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Memory exhaustion denial of service in the Linux kernel's netfs library: netfs_unbuffered_write() fails to drop a subrequest reference when subreq->io_iter resolves to zero length during subrequest preparation, so the reference is leaked (CWE-401). Local users with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) on systems that mount a netfs-backed filesystem and exercise it with direct/unbuffered I/O can repeatedly trigger the leak, degrading availability; there is no confidentiality or integrity impact despite one source tagging the issue as information disclosure. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.17% (5th percentile), and the priority signal places remediation in the this-month window rather than immediate action.
RemediationAI
Vendor-released patch: apply the kernel updates containing the netfs fix - 6.18.53 for the 6.18.y branch, 7.2.7 for the 7.2.y branch, or 7.3-rc3 and later on mainline - or cherry-pick the upstream stable commits ebefb12122d1319257ecac01c1a928f78007716a, 0a573f4283a965a5e8716f621aec404cb4575328 and 3c30087e27598d9d359763e8be9bd3017fe08348 from git.kernel.org (https://git.kernel.org/stable/c/ebefb12122d1319257ecac01c1a928f78007716a, https://git.kernel.org/stable/c/0a573f4283a965a5e8716f621aec404cb4575328, https://git.kernel.org/stable/c/3c30087e27598d9d359763e8be9bd3017fe08348); the NVD record is at https://nvd.nist.gov/vuln/detail/CVE-2026-98120. No vendor-documented workaround is given in the available sources; because exposure requires local low-privileged users combined with an active netfs-backed mount using direct I/O, restricting such mounts and direct-I/O usage to trusted users limits reachability until the kernel is updated, at the cost of removing legitimate unbuffered I/O workloads. There is no public exploit code and no KEV listing, so this fits a this-month patching cadence rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The netfs library is the shared helper layer beneath kernel network filesystems, and it splits write requests into subrequests whose lifetimes are managed by reference counts. The defect is a reference-count/lifetime error in the unbuffered (direct I/O) write path: when subreq->io_iter ends up zero length during preparation, netfs_unbuffered_write() returns without releasing the subrequest reference it holds, so the object is never freed - classified as CWE-401 (Missing Release of Memory After Effective Lifetime). The CPE entries (cpe:2.3:a:linux:linux) are the generic kernel product identifiers and do not narrow the affected subsystems, so the practical scope is limited to kernels carrying the vulnerable netfs code and to workloads that actually use netfs-backed filesystems with direct I/O. The trigger is specifically the zero-length io_iter condition described in the upstream fix; the available sources do not describe any other path to the leak. Note also that the accompanying tag set labels this as information disclosure, which conflicts with the assessed vector's C:N/I:N/A:H - the authoritative impact is availability only, via cumulative memory exhaustion from repeated triggering.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local direct-I/O write path reachable by a low-privileged user (AV:L/PR:L/AC:L); a reference leak causes memory exhaustion so A:H with no C/I impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix subreq ref leak
Fix a subrequest ref leak in netfs_unbuffered_write() in the event that subreq->io_iter ends up zero length during preparation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB