CVE-2026-98119

In the Linux kernel, the following vulnerability has been resolved:

netfs: break unbuffered write when netfs alloc subrequest() fails

syzbot reported a null-ptr-deref below [1] following a fault injection in netfs alloc subrequest(). [0]

When netfs alloc subrequest() fails, subreq is NULL. Later, netfs prepare write() tries to initialize members of subreq(e.g., source), the issue in [1] is triggered.

Let's handle the error of netfs prepare write() properly.

[0] FAULT INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Call Trace: netfs alloc subrequest+0x116/0x3f0 netfs prepare write+0x76/0x7b0 netfs unbuffered write+0x75c/0x2020 netfs unbuffered write iter locked+0x7d6/0xa80 netfs unbuffered write iter+0x442/0x720 v9fs file write iter+0xbf/0x100 vfs write+0x6ac/0x1050

[1] KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:netfs prepare write+0xbc/0x7b0 fs/netfs/write issue.c:173 Call Trace: netfs unbuffered write+0x75c/0x2020 fs/netfs/direct write.c:111 netfs unbuffered write iter locked+0x7d6/0xa80 fs/netfs/direct write.c:290 netfs unbuffered write iter+0x442/0x720 fs/netfs/direct write.c:382 v9fs file write iter+0xbf/0x100 fs/9p/vfs file.c:409 new sync write fs/read write.c:595 [inline]