CVE-2026-98120

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98120", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.318Z", "datePublished": "2026-09-25T10:36:04.129Z", "dateUpdated": "2026-10-19T09:14:12.388Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:14:12.388Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix subreq ref leak\n\nFix a subrequest ref leak in netfs_unbuffered_write() in the event that\nsubreq->io_iter ends up zero length during preparation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/direct_write.c"], "versions": [{"version": "72d08d2839649d1c5efbe375751f4473fa4486af", "lessThan": "ebefb12122d1319257ecac01c1a928f78007716a", "status": "affected", "versionType": "git"}, {"version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "lessThan": "0a573f4283a965a5e8716f621aec404cb4575328", "status": "affected", "versionType": "git"}, {"version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "lessThan": "3c30087e27598d9d359763e8be9bd3017fe08348", "status": "affected", "versionType": "git"}, {"version": "0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0", "status": "affected", "versionType": "git"}, {"version": "6.18.17", "lessThan": "6.18.53", "status": "affected", "versionType": "semver"}, {"version": "6.19.7", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/direct_write.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.17", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ebefb12122d1319257ecac01c1a928f78007716a"}, {"url": "https://git.kernel.org/stable/c/0a573f4283a965a5e8716f621aec404cb4575328"}, {"url": "https://git.kernel.org/stable/c/3c30087e27598d9d359763e8be9bd3017fe08348"}], "title": "netfs: Fix subreq ref leak", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/direct_write.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ebefb12122d1319257ecac01c1a928f78007716a", "status": "affected", "version": "72d08d2839649d1c5efbe375751f4473fa4486af", "versionType": "git"}, {"lessThan": "0a573f4283a965a5e8716f621aec404cb4575328", "status": "affected", "version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "versionType": "git"}, {"lessThan": "3c30087e27598d9d359763e8be9bd3017fe08348", "status": "affected", "version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2", "versionType": "git"}, {"status": "affected", "version": "0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0", "versionType": "git"}, {"lessThan": "6.18.53", "status": "affected", "version": "6.18.17", "versionType": "semver"}, {"lessThan": "6.20", "status": "affected", "version": "6.19.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/netfs/direct_write.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "71BEAF6F-F7D6-466E-9CA6-0C20FF291CA2", "versionEndExcluding": "6.18.53", "versionStartIncluding": "6.18.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A49CE00-8680-45A8-9708-2627B6847D29", "versionEndExcluding": "7.0", "versionStartIncluding": "6.19.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "74F429CD-F164-4144-868B-B06E1F78CF36", "versionEndExcluding": "7.2.7", "versionStartIncluding": "7.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*", "matchCriteriaId": "EF897730-3F1E-47A2-8B07-22535202C487", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*", "matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*", "matchCriteriaId": "14FD7B9A-4946-4511-8E63-6E13870CD4A8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix subreq ref leak\n\nFix a subrequest ref leak in netfs_unbuffered_write() in the event that\nsubreq->io_iter ends up zero length during preparation."}], "id": "CVE-2026-98120", "lastModified": "2026-10-26T18:36:37.413", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-09-25T11:17:43.253", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a573f4283a965a5e8716f621aec404cb4575328"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c30087e27598d9d359763e8be9bd3017fe08348"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ebefb12122d1319257ecac01c1a928f78007716a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfs: Fix subreq ref leak", "id": "2541336", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541336"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfs: Fix subreq ref leak\nFix a subrequest ref leak in netfs_unbuffered_write() in the event that\nsubreq->io_iter ends up zero length during preparation.", "A flaw was found in the Linux kernel's netfs (network filesystem) subsystem. A local user can cause a Denial of Service (DoS) by initiating specific unbuffered write operations on an affected filesystem. When a write subrequest encounters zero-length data during preparation, the kernel fails to release an internal reference count. This reference leak causes kernel memory to remain allocated indefinitely, which can eventually lead to resource exhaustion and system instability."], "name": "CVE-2026-98120", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98120\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98120\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98120.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[72d08d2839649d1c5efbe375751f4473fa4486af,ebefb12122d1319257ecac01c1a928f78007716a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0b4c7a49137ed21279f354eb59f49ddae8dffc2,0a573f4283a965a5e8716f621aec404cb4575328)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0b4c7a49137ed21279f354eb59f49ddae8dffc2,3c30087e27598d9d359763e8be9bd3017fe08348)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.17,6.18.53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.19.7,6.20)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T12:45:17.067644+00:00", "updated": "2026-10-26T20:45:14.130370+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}