CVE-2026-97610netfs: Fix uninitialized return value in netfs_unbuffered_write()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfs_unbuffered_write() If preparation of the first subrequest fails, netfs_unbuffered_write() exits its loop before ret is initialized. The empty-iterator check can do the same. For synchronous writes, netfs_unbuffered_write_iter_locked() may then return an unrelated error instead of wreq->error. This is reachable through CIFS if cifs_prepare_write() fails to reopen the file or obtain credits. Initialize ret to 0 so the caller returns wreq->error if no data was written, or the number of bytes already written otherwise. Found with Clang's -Wconditional-uninitialized.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 72d08d2839649d1c5efbe375751f4473fa4486af builds before 3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26; from a0b4c7a49137ed21279f354eb59f49ddae8dffc2 before 2e38d500471d097cda87d7d374bbc1b13493075d; from a0b4c7a49137ed21279f354eb59f49ddae8dffc2 before f18e8774f4d3137fa0a5fb8ffa83d59a719666d8; 0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0; from 6.18.17 before 6.18.53; from 6.19.7 before 6.20 | CNA record |
References
- https://git.kernel.org/stable/c/3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26
- https://git.kernel.org/stable/c/2e38d500471d097cda87d7d374bbc1b13493075d
- https://git.kernel.org/stable/c/f18e8774f4d3137fa0a5fb8ffa83d59a719666d8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.