CVE-2026-97610

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97610", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.158Z", "datePublished": "2026-09-25T10:22:20.228Z", "dateUpdated": "2026-10-19T09:10:14.001Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:10:14.001Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix uninitialized return value in netfs_unbuffered_write()\n\nIf preparation of the first subrequest fails,\nnetfs_unbuffered_write() exits its loop before ret is initialized. The\nempty-iterator check can do the same.\n\nFor synchronous writes, netfs_unbuffered_write_iter_locked() may then\nreturn an unrelated error instead of wreq->error. This is reachable\nthrough CIFS if cifs_prepare_write() fails to reopen the file or obtain\ncredits.\n\nInitialize ret to 0 so the caller returns wreq->error if no data was\nwritten, or the number of bytes already written otherwise.\n\nFound with Clang's -Wconditional-uninitialized."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/direct_write.c"], "versions": [{"version": "72d08d2839649d1c5efbe375751f4473fa4486af", "lessThan": "3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26", "status": "affected", "versionType": "git"}, {"version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "lessThan": "2e38d500471d097cda87d7d374bbc1b13493075d", "status": "affected", "versionType": "git"}, {"version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "lessThan": "f18e8774f4d3137fa0a5fb8ffa83d59a719666d8", "status": "affected", "versionType": "git"}, {"version": "0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0", "status": "affected", "versionType": "git"}, {"version": "6.18.17", "lessThan": "6.18.53", "status": "affected", "versionType": "semver"}, {"version": "6.19.7", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/direct_write.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.17", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26"}, {"url": "https://git.kernel.org/stable/c/2e38d500471d097cda87d7d374bbc1b13493075d"}, {"url": "https://git.kernel.org/stable/c/f18e8774f4d3137fa0a5fb8ffa83d59a719666d8"}], "title": "netfs: Fix uninitialized return value in netfs_unbuffered_write()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/direct_write.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26", "status": "affected", "version": "72d08d2839649d1c5efbe375751f4473fa4486af", "versionType": "git"}, {"lessThan": "2e38d500471d097cda87d7d374bbc1b13493075d", "status": "affected", "version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "versionType": "git"}, {"lessThan": "f18e8774f4d3137fa0a5fb8ffa83d59a719666d8", "status": "affected", "version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "versionType": "git"}, {"status": "affected", "version": "0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0", "versionType": "git"}, {"lessThan": "6.18.53", "status": "affected", "version": "6.18.17", "versionType": "semver"}, {"lessThan": "6.20", "status": "affected", "version": "6.19.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/netfs/direct_write.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix uninitialized return value in netfs_unbuffered_write()\n\nIf preparation of the first subrequest fails,\nnetfs_unbuffered_write() exits its loop before ret is initialized. The\nempty-iterator check can do the same.\n\nFor synchronous writes, netfs_unbuffered_write_iter_locked() may then\nreturn an unrelated error instead of wreq->error. This is reachable\nthrough CIFS if cifs_prepare_write() fails to reopen the file or obtain\ncredits.\n\nInitialize ret to 0 so the caller returns wreq->error if no data was\nwritten, or the number of bytes already written otherwise.\n\nFound with Clang's -Wconditional-uninitialized."}], "id": "CVE-2026-97610", "lastModified": "2026-10-19T10:17:31.027", "metrics": {}, "published": "2026-09-25T11:17:15.100", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e38d500471d097cda87d7d374bbc1b13493075d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f18e8774f4d3137fa0a5fb8ffa83d59a719666d8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfs: Fix uninitialized return value in netfs_unbuffered_write()", "id": "2541016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541016"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfs: Fix uninitialized return value in netfs_unbuffered_write()\nIf preparation of the first subrequest fails,\nnetfs_unbuffered_write() exits its loop before ret is initialized. The\nempty-iterator check can do the same.\nFor synchronous writes, netfs_unbuffered_write_iter_locked() may then\nreturn an unrelated error instead of wreq->error. This is reachable\nthrough CIFS if cifs_prepare_write() fails to reopen the file or obtain\ncredits.\nInitialize ret to 0 so the caller returns wreq->error if no data was\nwritten, or the number of bytes already written otherwise.\nFound with Clang's -Wconditional-uninitialized.", "A flaw was found in the Linux kernel's netfs (network filesystem) subsystem. A local user can cause a Denial of Service (DoS) or unexpected system behavior during synchronous unbuffered write operations on network filesystems, such as CIFS (Common Internet File System). When an initial write preparation step fails or an empty data iterator is encountered, the kernel exits early without initializing a return variable. Consequently, an arbitrary value is returned instead of the actual error status, resulting in incorrect error handling and potential system instability."], "name": "CVE-2026-97610", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97610\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97610\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97610.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[72d08d2839649d1c5efbe375751f4473fa4486af,3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0b4c7a49137ed21279f354eb59f49ddae8dffc2,2e38d500471d097cda87d7d374bbc1b13493075d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0b4c7a49137ed21279f354eb59f49ddae8dffc2,f18e8774f4d3137fa0a5fb8ffa83d59a719666d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.17,6.18.53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:30:19.721078+00:00", "updated": "2026-10-01T11:30:05.846225+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}