CVE-2026-98120

A flaw was found in the Linux kernel's netfs (network filesystem) subsystem. A local user can cause a Denial of Service (DoS) by initiating specific unbuffered write operations on an affected filesystem. When a write subrequest encounters zero-length data during preparation, the kernel fails to release an internal reference count. This reference leak causes kernel memory to remain allocated indefinitely, which can eventually lead to resource exhaustion and system instability.

A low impact flaw was found in the Linux kernel netfs subsystem. When an unbuffered or direct-I/O write in netfs_unbuffered_write() encounters a subrequest whose I/O iterator ends up zero length during preparation, the kernel exits the dispatch loop without releasing the subrequest reference. A local user able to write to a file on an affected netfs-backed (network filesystem) mount can repeatedly trigger this condition, causing kernel memory associated with the leaked subrequests to remain allocated indefinitely, which can eventually lead to resource exhaustion and a denial of service. The flaw has no impact on confidentiality or integrity.

Of the Red Hat products assessed, only Red Hat Enterprise Linux 10.3 and 10.4 and Red Hat In-Vehicle OS 2 (including its core streams and the kernel-ivos-qualcomm component) contain the vulnerable code and are affected; the fix for these streams is deferred. Red Hat Enterprise Linux 6, 7, 8, and 9 streams, RHEL 10.0 and 10.2, the kernel-rt real-time kernel, and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in them. The deferral reflects the low severity of the issue: exploitation requires a local, low-privileged user on a system using a netfs-backed filesystem, triggering depends on the write subrequest iterator reaching an unexpected zero-length state, and the result is limited to resource leakage and stalled writes rather than memory corruption. The residual risk is that repeated triggering could accumulate leaked subrequest references and degrade system availability over time. Red Hat rates this flaw LOW impact, lower than an initial automated severity estimate, because no use-after-free, out-of-bounds access, information disclosure, or write primitive is involved.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.