CVE-2026-31437: Linux Kernel NULL Pointer Vulnerability

CVE-2026-31437 Overview

CVE-2026-31437 is a NULL pointer dereference vulnerability in the Linux kernel's network filesystem (netfs) subsystem. The flaw resides in the netfs_unbuffered_write() function at fs/netfs/direct_write.c:189. When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path unconditionally invokes stream->prepare_write() without verifying that the function pointer is non-NULL. Filesystems such as 9P do not implement the prepare_write operation, leaving the pointer NULL. When get_user_pages() fails with -EFAULT and the subrequest is flagged for retry, the kernel dereferences a NULL function pointer.

Critical Impact
Local triggering of a kernel NULL pointer dereference results in a kernel oops or panic, causing denial of service on systems using affected netfs-backed filesystems such as 9P.

Affected Products

Linux kernel netfs subsystem (fs/netfs/direct_write.c)
9P filesystem (v9fs) and any netfs-backed filesystem that does not implement prepare_write
Distributions shipping vulnerable upstream kernel revisions prior to the fix commits

Discovery Timeline

2026-04-22 - CVE-2026-31437 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31437

Vulnerability Analysis

The Linux netfs subsystem provides a shared infrastructure for network filesystems handling buffered and unbuffered I/O. The netfs_unbuffered_write() function manages direct write operations through subrequests that may need to be retried when transient errors occur. Each write stream exposes a set of operation hooks, including prepare_write, which renegotiates parameters before a retry. This hook is optional, and several filesystems leave it undefined.

The defective retry path assumed prepare_write would always be available. When a subrequest is flagged with NETFS_SREQ_NEED_RETRY after get_user_pages() returns -EFAULT, the function dispatches directly to stream->prepare_write() without a NULL check. On filesystems such as 9P, this dereference triggers a kernel oops at fs/netfs/direct_write.c:189.

Root Cause

The root cause is missing input validation on an optional function pointer [CWE-476]. The retry logic in netfs_unbuffered_write() diverged from the established pattern in write_retry.c, which already guards against a NULL prepare_write by falling back to netfs_reissue_write(). The fix mirrors that pattern: when stream->prepare_write is NULL, renegotiation is skipped and the subrequest is reissued directly. netfs_reissue_write() handles the iterator reset, the IN_PROGRESS flag, statistics update, and the reissue internally.

Attack Vector

A local user performs an unbuffered (direct I/O) write against a netfs-backed filesystem that omits prepare_write, such as a mounted 9P share. By inducing a fault during get_user_pages(), for example through a write buffer that becomes unmapped or inaccessible, the user causes the subrequest to enter the retry path. The kernel then dereferences the NULL prepare_write pointer and panics. No special privileges beyond the ability to issue writes against the affected mount are required.

No verified public exploit code is available. See the upstream patches for technical specifics: Kernel Git Commit 7a5482f, Kernel Git Commit a4d1b4b, and Kernel Git Commit e9075e4.

Detection Methods for CVE-2026-31437

Indicators of Compromise

Kernel oops or panic messages referencing netfs_unbuffered_write or fs/netfs/direct_write.c in dmesg or /var/log/kern.log
Stack traces showing a NULL pointer dereference following a call chain into the netfs write retry path
Crash entries correlated with workloads writing to 9P or similar netfs-backed mounts using direct I/O

Detection Strategies

Audit running kernel versions against the fix commits 7a5482f, a4d1b4b, and e9075e4 to identify unpatched systems
Monitor host telemetry for repeated kernel crashes originating from netfs write paths
Inventory mounted filesystem types and flag hosts using 9P or other netfs filesystems without prepare_write defined

Monitoring Recommendations

Forward kernel ring buffer events and kdump artifacts to a central log store for crash pattern analysis
Alert on processes performing direct-I/O writes to 9P mounts immediately preceding kernel faults
Track kernel package versions through configuration management and compare against vendor advisories

How to Mitigate CVE-2026-31437

Immediate Actions Required

Apply the upstream kernel patches 7a5482f5ce89, a4d1b4ba9754, or e9075e420a1e once available through your distribution
Restrict use of 9P and similar netfs-backed filesystems that omit prepare_write on multi-tenant or untrusted hosts until patched
Enable kernel crash dump collection (kdump) to capture forensic evidence of any exploitation attempts

Patch Information

The fix adds a NULL check for stream->prepare_write in netfs_unbuffered_write(). When the pointer is NULL, the retry path skips renegotiation and calls netfs_reissue_write() directly. The corrected logic mirrors the pattern already present in write_retry.c. Patches are available at Kernel Git Commit 7a5482f, Kernel Git Commit a4d1b4b, and Kernel Git Commit e9075e4.

Workarounds

Avoid direct (O_DIRECT) writes against 9P and other netfs-backed filesystems lacking a prepare_write operation
Unmount affected netfs filesystems on hosts where local users could trigger faulting write buffers
Limit local shell or container access to systems exposing vulnerable mounts until kernels are updated

bash

# Verify the running kernel version and check for the fix
uname -r
rpm -q --changelog kernel | grep -E '7a5482f|a4d1b4b|e9075e4' || \
  dpkg-query -W -f='${Version}\n' linux-image-$(uname -r)