CVE-2026-31438

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators

When a process crashes and the kernel writes a core dump to a 9P filesystem, __kernel_write() creates an ITER_KVEC iterator. This iterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which only handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types, hitting the BUG() for any other type.

Fix this by adding netfs_limit_kvec() following the same pattern as netfs_limit_bvec(), since both kvec and bvec are simple segment arrays with pointer and length fields. Dispatch it from netfs_limit_iter() when the iterator type is ITER_KVEC.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

VendorProductVersions
LinuxLinux>= cae932d3aee55035a54415dcea8e7ecf2ec469b5, < 18c2e20b42dd21db599e42d05ddaeeb647b2bb6d; >= cae932d3aee55035a54415dcea8e7ecf2ec469b5, < 4bc2d72c7695cedf6d4e1a558924903c2b28a78e; >= cae932d3aee55035a54415dcea8e7ecf2ec469b5, < 00d6df7115f6972370974212de9088087820802e; >= cae932d3aee55035a54415dcea8e7ecf2ec469b5, < 67e467a11f62ff64ad219dc6aa5459e132c79d14
LinuxLinux6.8

References

Timeline

Published
Apr 22, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-314395.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap init error handling devm_regmap_inCVE-2026-31449.8IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the applicatCVE-2026-314405.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix leaking event log memory During the device removeCVE-2026-314415.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix memory leak when a wq is reset idxd_wq_disable_clCVE-2026-314427.8In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible invalid memory access after FLR In the cCVE-2026-314435.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix crash when the event log is disabled If reportingCVE-2026-314449.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() smb_graCVE-2026-314455.5In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid use of half-online-committed context One major usCVE-2026-314467.8In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umount CVE-2026-314477.8In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc wCVE-2026-314489.4In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod CVE-2026-314497.8In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_corre