CVE-2026-98120
netfs: Fix subreq ref leak
MEDIUM
5.5
CVSS Score
Published: September 25, 2026 at 10:36 AM UTC
Updated: October 26, 2026 at 06:36 PM UTC
1 product affected across 1 vendorLinux Kernel
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%
Description
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfs_unbuffered_write() in the event that subreq->io_iter ends up zero length during preparation.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
6.18.17 ≤ v < 6.18.536.19.7 ≤ v < 7.07.0.1 ≤ v < 7.2.70c29f6d63122a0168d67cb8ecde5b4cf7fe4acb06.18.176.19.77.07.372d08d2839649d1c5efbe375751f4473fa4486afa0b4c7a49137ed21279f354eb59f49ddae8dffc2
Vendor states this is fixed in 0a573f4283a965a5e8716f621aec404cb4575328 (fixed)
Vendor states this is fixed in 3c30087e27598d9d359763e8be9bd3017fe08348 (fixed)
Vendor states this is fixed in ebefb12122d1319257ecac01c1a928f78007716a (fixed)
Vendor states this is fixed in 6.18.53 (unaffected)
Affected range stops below 6.20, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 7.0 (unaffected)
Vendor states this is fixed in 7.2.7 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc3 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (3)
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusANALYZED
CWE
CWE-401
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card