CVE Explorer

CVE-2026-31437

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path in netfs_unbuffered_write() unconditionally calls stream->prepare_write() without checking if it is NULL. Filesystems such as 9P do not set the prepare_write operation, so stream->prepare_write remains NULL. When get_user_pages() fails with -EFAULT and the subrequest is flagged for r

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:171f0296293f6d8f1e8176f99bf13d2f48dc9853ba074b1cb939666e29da5859

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a4d1b4ba9754bac3efebd06f583a44a7af52c0ab","status":"affected","version":"72d08d2839649d1c5efbe375751f4473fa4486af","versionType":"git"},{"lessThan":"7a5482f5ce891decbf36f2e6fab1e9fc4a76a684","status":"affected","version":"0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0","versionType":"git"},{"lessThan":"e9075e420a1eb3b52c60f3b95893a55e77419ce8","status":"affected","version":"a0b4c7a49137ed21279f35…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a284c352bf2a49c0e4c95b2fb79594f09c2bb9da499e7bc69b06203916d560b8 · sha256:0ed4d48182b29938… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.21","status":"affected","version":"6.18.17","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.7","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a284c352bf2a49c0e4c95b2fb79594f09c2bb9da499e7bc69b06203916d560b8 · sha256:0ed4d48182b29938… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a284c352bf2a49c0e4c95b2fb79594f09c2bb9da499e7bc69b06203916d560b8 · sha256:0ed4d48182b29938… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.21","status":"affected","version":"6.18.17","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.7","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a284c352bf2a49c0e4c95b2fb79594f09c2bb9da499e7bc69b06203916d560b8 · sha256:0ed4d48182b29938… · /containers/cna/affected/1

Source references

3 source assertions

{"url":"https://git.kernel.org/stable/c/7a5482f5ce891decbf36f2e6fab1e9fc4a76a684"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a284c352bf2a49c0e4c95b2fb79594f09c2bb9da499e7bc69b06203916d560b8 · sha256:0ed4d48182b29938… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/a4d1b4ba9754bac3efebd06f583a44a7af52c0ab"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a284c352bf2a49c0e4c95b2fb79594f09c2bb9da499e7bc69b06203916d560b8 · sha256:0ed4d48182b29938… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/e9075e420a1eb3b52c60f3b95893a55e77419ce8"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a284c352bf2a49c0e4c95b2fb79594f09c2bb9da499e7bc69b06203916d560b8 · sha256:0ed4d48182b29938… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer