CVE-2026-31437

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix NULL pointer dereference in netfsunbufferedwrite() on retry

When a write subrequest is marked NETFSSREQNEEDRETRY, the retry path in netfsunbufferedwrite() unconditionally calls stream->preparewrite() without checking if it is NULL.

Filesystems such as 9P do not set the preparewrite operation, so stream->preparewrite remains NULL. When getuserpages() fails with -EFAULT and the subrequest is flagged for retry, this results in a NULL pointer dereference at fs/netfs/direct_write.c:189.

Fix this by mirroring the pattern already used in writeretry.c: if stream->preparewrite is NULL, skip renegotiation and directly reissue the subrequest via netfsreissuewrite(), which handles iterator reset, IN_PROGRESS flag, stats update and reissue internally.