CVE-2026-31435CWE-125CWE-457

CVE-2026-31435

High · published April 22, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix read abandonment during retry

Under certain circumstances, all the remaining subrequests from a read

request will get abandoned during retry. The abandonment process expects

the 'subreq' variable to be set to the place to start abandonment from, but

it doesn't always have a useful value (it will be uninitialised on the

first pass through the loop and it may point to a deleted subrequest on

later passes).

Fix the first jump to "abandon:" to set subreq to the start of the first

subrequest expected to need retry (which, in this abandonment case, turned

out unexpectedly to no longer have NEED_RETRY set).

Also clear the subreq pointer after discarding superfluous retryable

subrequests to cause an oops if we do try to access it.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-457 · Use of Uninitialized Variable
Published
2026-04-22T18:16Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 6.12, < 6.18.216.18.21
linux/linux_kernel≥ 6.19, < 6.19.116.19.11
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 22 APR 13:53Z
    netfs: Fix read abandonment during retry
    cvelistv5