FKIE_CVE-2026-97610

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 11:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfs_unbuffered_write() If preparation of the first subrequest fails, netfs_unbuffered_write() exits its loop before ret is initialized. The empty-iterator check can do the same. For synchronous writes, netfs_unbuffered_write_iter_locked() may then return an unrelated error instead of wreq->error. This is reachable through CIFS if cifs_prepare_write() fails to reopen the file or obtain credits. Initialize ret to 0 so the caller returns wreq->error if no data was written, or the number of bytes already written otherwise. Found with Clang's -Wconditional-uninitialized.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2e38d500471d097cda87d7d374bbc1b13493075d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f18e8774f4d3137fa0a5fb8ffa83d59a719666d8
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/direct_write.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26",
              "status": "affected",
              "version": "72d08d2839649d1c5efbe375751f4473fa4486af",
              "versionType": "git"
            },
            {
              "lessThan": "2e38d500471d097cda87d7d374bbc1b13493075d",
              "status": "affected",
              "version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2",
              "versionType": "git"
            },
            {
              "lessThan": "f18e8774f4d3137fa0a5fb8ffa83d59a719666d8",
              "status": "affected",
              "version": "a0b4c7a49137ed21279f354eb59f49ddae8dffc2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/direct_write.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix uninitialized return value in netfs_unbuffered_write()\n\nIf preparation of the first subrequest fails,\nnetfs_unbuffered_write() exits its loop before ret is initialized. The\nempty-iterator check can do the same.\n\nFor synchronous writes, netfs_unbuffered_write_iter_locked() may then\nreturn an unrelated error instead of wreq-\u003eerror. This is reachable\nthrough CIFS if cifs_prepare_write() fails to reopen the file or obtain\ncredits.\n\nInitialize ret to 0 so the caller returns wreq-\u003eerror if no data was\nwritten, or the number of bytes already written otherwise.\n\nFound with Clang\u0027s -Wconditional-uninitialized."
    }
  ],
  "id": "CVE-2026-97610",
  "lastModified": "2026-09-25T11:17:15.100",
  "metrics": {},
  "published": "2026-09-25T11:17:15.100",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2e38d500471d097cda87d7d374bbc1b13493075d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f18e8774f4d3137fa0a5fb8ffa83d59a719666d8"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.