CVE-2026-31435: Linux Kernel Netfs DoS Vulnerability

CVE-2026-31435 Overview

CVE-2026-31435 affects the Linux kernel's network filesystem (netfs) subsystem. The flaw involves improper handling of the subreq variable during read request retries. Under certain conditions, the kernel abandons remaining subrequests from a read request using an uninitialized or stale pointer. The subreq variable may be uninitialized on the first loop pass or reference a deleted subrequest on subsequent passes. This results in undefined behavior within kernel memory, potentially leading to memory corruption or system instability. The issue has been resolved upstream through patches in the stable kernel tree.

Critical Impact

A network-adjacent attacker can trigger memory corruption in the netfs read retry path, threatening confidentiality, integrity, and availability of affected Linux systems.

Affected Products

• Linux kernel (netfs subsystem)
• Distributions shipping vulnerable kernel versions prior to the referenced stable commits
• Network filesystem clients relying on netfs read retry logic

Discovery Timeline

• 2026-04-22 - CVE-2026-31435 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31435

Vulnerability Analysis

The vulnerability resides in the Linux kernel's netfs read retry handling logic. The netfs layer manages read operations that may span multiple subrequests against network filesystems. When retry conditions occur, the kernel can enter an abandonment path to discard outstanding subrequests.

The abandonment routine assumes the subreq variable holds a valid pointer marking where abandonment should begin. This assumption fails in two scenarios. On the first iteration of the retry loop, subreq may be uninitialized. On later iterations, subreq may reference a subrequest that has already been deleted.

Dereferencing this pointer during abandonment leads to use-after-free or uninitialized memory access in kernel space. The CWE classification aligns with [CWE-416] Use After Free and [CWE-908] Use of Uninitialized Resource.

Root Cause

The root cause is missing initialization and stale-pointer reuse in the netfs retry abandonment path. The first jump to the abandon: label did not set subreq to a valid starting subrequest. Additionally, the pointer was not cleared after discarding superfluous retryable subrequests, allowing it to persist as a dangling reference.

Attack Vector

The attack vector is network-based with user interaction required. An attacker controlling or influencing a network filesystem server can induce specific retry conditions where the NEED_RETRY flag transitions unexpectedly. Triggering the flawed code path can corrupt kernel memory or crash the system. Successful exploitation impacts confidentiality, integrity, and availability of the host.

The upstream fix updates the first jump to abandon: to set subreq to the first subrequest expected to need retry. The fix also clears the subreq pointer after discarding superfluous retryable subrequests so that any erroneous later access produces an immediate oops rather than silent corruption.

Detection Methods for CVE-2026-31435

Indicators of Compromise

• Kernel oops or panic messages referencing netfs functions during read retry operations
• Unexpected process crashes or kernel warnings on hosts mounting network filesystems
• Stack traces in dmesg involving netfs subrequest abandonment paths
• Repeated read retries against network filesystem endpoints preceding kernel instability

Detection Strategies

• Inventory running kernel versions and compare against the patched commits 3e5fd8f53b57, 7e57523490cd, and 8f2f2bd128a8
• Monitor dmesg and journal logs for netfs-related warnings, BUG, or oops entries
• Audit systems using network filesystems such as Ceph, AFS, 9P, or other netfs-backed clients

Monitoring Recommendations

• Forward kernel logs to a centralized logging platform for correlation across hosts
• Alert on repeated kernel oops events tied to netfs read paths
• Track abnormal network filesystem retry counts and disconnection patterns from servers

How to Mitigate CVE-2026-31435

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced by commits 3e5fd8f53b57, 7e57523490cd, and 8f2f2bd128a8
• Update to a stable kernel release containing the netfs retry fix from your distribution vendor
• Restrict use of network filesystems on unpatched hosts to trusted servers only
• Reboot affected systems after kernel update to activate the patched code

Patch Information

The fix is available in the mainline and stable Linux kernel trees. See the Kernel Git Commit 3e5fd8f53b57, Kernel Git Commit 7e57523490cd, and Kernel Git Commit 8f2f2bd128a8 for the patch source. Distribution maintainers are backporting the fix to supported stable branches.

Workarounds

• Unmount network filesystems on systems where patching is not yet possible
• Limit network filesystem clients to controlled, trusted server environments
• Disable automatic retry behavior in mount options where supported by the filesystem driver

# Verify running kernel version and check for patch presence
uname -r

# Update kernel on Debian/Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# Update kernel on RHEL/CentOS/Fedora
sudo dnf update kernel

# Reboot to activate patched kernel
sudo systemctl reboot