{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31435", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.089Z", "datePublished": "2026-04-22T13:53:35.032Z", "dateUpdated": "2026-04-22T13:53:35.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-22T13:53:35.032Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix read abandonment during retry\n\nUnder certain circumstances, all the remaining subrequests from a read\nrequest will get abandoned during retry. The abandonment process expects\nthe 'subreq' variable to be set to the place to start abandonment from, but\nit doesn't always have a useful value (it will be uninitialised on the\nfirst pass through the loop and it may point to a deleted subrequest on\nlater passes).\n\nFix the first jump to \"abandon:\" to set subreq to the start of the first\nsubrequest expected to need retry (which, in this abandonment case, turned\nout unexpectedly to no longer have NEED_RETRY set).\n\nAlso clear the subreq pointer after discarding superfluous retryable\nsubrequests to cause an oops if we do try to access it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/read_retry.c"], "versions": [{"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e", "lessThan": "3e5fd8f53b575ff2188f82071da19c977ca56c41", "status": "affected", "versionType": "git"}, {"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e", "lessThan": "8f2f2bd128a8d9edbc1e785760da54ada3df69b7", "status": "affected", "versionType": "git"}, {"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e", "lessThan": "7e57523490cd2efb52b1ea97f2e0a74c0fb634cd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/read_retry.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e5fd8f53b575ff2188f82071da19c977ca56c41"}, {"url": "https://git.kernel.org/stable/c/8f2f2bd128a8d9edbc1e785760da54ada3df69b7"}, {"url": "https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}], "title": "netfs: Fix read abandonment during retry", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix read abandonment during retry\n\nUnder certain circumstances, all the remaining subrequests from a read\nrequest will get abandoned during retry. The abandonment process expects\nthe 'subreq' variable to be set to the place to start abandonment from, but\nit doesn't always have a useful value (it will be uninitialised on the\nfirst pass through the loop and it may point to a deleted subrequest on\nlater passes).\n\nFix the first jump to \"abandon:\" to set subreq to the start of the first\nsubrequest expected to need retry (which, in this abandonment case, turned\nout unexpectedly to no longer have NEED_RETRY set).\n\nAlso clear the subreq pointer after discarding superfluous retryable\nsubrequests to cause an oops if we do try to access it."}], "id": "CVE-2026-31435", "lastModified": "2026-04-22T14:16:36.710", "metrics": {}, "published": "2026-04-22T14:16:36.710", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e5fd8f53b575ff2188f82071da19c977ca56c41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8f2f2bd128a8d9edbc1e785760da54ada3df69b7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfs: Fix read abandonment during retry", "id": "2460660", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460660"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's netfs component. Under certain circumstances, during a read retry operation, the system may incorrectly abandon subrequests. This issue arises because a pointer (`subreq`) used in the abandonment process can be uninitialized or point to invalid memory. An attacker could potentially exploit this to trigger a kernel oops, leading to a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-31435", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31435\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31435\nhttps://lore.kernel.org/linux-cve-announce/2026042242-CVE-2026-31435-f0f5@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ee4cdf7ba857a894ad1650d6ab77669cbbfa329e,3e5fd8f53b575ff2188f82071da19c977ca56c41)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ee4cdf7ba857a894ad1650d6ab77669cbbfa329e,8f2f2bd128a8d9edbc1e785760da54ada3df69b7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ee4cdf7ba857a894ad1650d6ab77669cbbfa329e,7e57523490cd2efb52b1ea97f2e0a74c0fb634cd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-22T19:17:45.993285+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to the patched version where the netfs read abandonment bug is fixed.", "Disable or remove netfs-related services (e.g., NFS clients or servers) if an update cannot be applied immediately.", "Continuously monitor kernel logs for oops messages to detect any attempted exploitation."], "summary": {"action": "Apply Patch", "impact": "Denial of Service via kernel crash"}, "threat_synthesis": {"affected_systems": "All Linux kernel installations that include the netfs subsystem prior to the applied fix are affected, including standard distributions that ship the unpatched kernel. The issue resides in the network file system read handling code, so any system exposed to NFS traffic (clients or servers) is at risk.", "description_and_impact": "In the Linux kernel, the netfs module had an error where read requests could abandon all remaining subrequests during retry. The bug arises due to an uninitialized or dangling subrequest pointer, causing the kernel to trigger an oops and crash when the retry logic attempts to process invalid memory. This results in a denial of service, as the crash can bring the system down or require a reboot.", "risk_and_exploitability": "The vulnerability is a critical kernel bug that can lead to a crash, but it lacks a publicly available exploitation reference. EPSS is not available and KEV does not list it, suggesting limited exploitation in the wild. The attack likely requires the ability to trigger a problematic read operation over a network file system, meaning that an attacker with network access to the affected service could potentially force a failure. The risk therefore remains high for exposed systems, and patching should be prioritized."}}}}, "created": "2026-04-22T16:30:21.826613+00:00", "updated": "2026-04-22T19:30:24.744669+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-457", "CWE-416"]}