Medium [CVE-2026-64068] Fix missing locking around retry adding new subreqs

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests.

An attacker could potentially exploit this race condition, which may lead to system instability or a denial of service (DoS). A race in netfs retry handling occurs because retry paths modify stream subrequests without holding the request spinlock while other code may inspect or update the same list.

Concurrent list add or delete around retry read or write subrequests can corrupt list state or leave stale subrequest links, and the surrounding code also drops subrequest references after deletion.

For the CVSS the PR:L is used for the paranoid score because a local unprivileged process with access to a mounted netfs backed filesystem may be able to trigger retry paths through normal file IO, while reliable triggering still depends on retry timing and filesystem conditions.

The issue is not a generic Internet reachable network bug, but a malicious or unstable backing server may help create retry conditions. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact if list corruption turns into use after free or stale pointer use.