In the Linux kernel, netfs_unbuffered_write() contains an unconditional call to stream->prepare_write when a write subrequest is marked NETFS_SREQ_NEED_RETRY. Filesystems such as 9P do not implement prepare_write, leaving the function pointer NULL. When get_user_pages() fails with –EFAULT and the subrequest is flagged for retry, this results in a NULL pointer dereference at fs/netfs/direct_write.c:189, causing a kernel OOPS. This indicates a classic null pointer dereference weakness (CWE‑476) and can lead to an unprivileged kernel crash, providing a denial‑of‑service and a potential escalation surface if the fault is leveraged further.

All Linux kernel versions prior to the commit that introduces the NULL check are vulnerable. The issue affects any system that mounts a netfs implementation that does not provide a prepare_write function, notably the 9P filesystem. The vulnerability is present in every pre‑patch kernel revision and is fixed in kernels that incorporate the referenced commit URLs.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of < 1 % suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a local attacker with write access to a netfs file can trigger the crash by causing a write failure and retry. The risk is therefore a local denial‑of‑service that could be exploited to destabilize the system or, in some circumstances, enable privilege escalation.