CVE-2026-98267

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: 9p: Fix v9fs_issue_write() to update i_size and remote_i_size Fix v9fs_issue_write() to update i_size and remote_i_size to the new size of the server file if we made it larger, using the start fpos and the count returned by p9_client_write() to calculate the new minimum file size. This assumes that if the 9P server makes a short write (say it hits ENOSPC), a reduced count is returned.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98267

EUVD

EUVD-2026-93195

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5fb70e7275a61dd404f684370e1add7fe0ebe9c5
Linux	Linux	5fb70e7275a61dd404f684370e1add7fe0ebe9c5
Linux	Linux	5fb70e7275a61dd404f684370e1add7fe0ebe9c5
Linux	Linux	5fb70e7275a61dd404f684370e1add7fe0ebe9c5
Linux	Linux	6.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the v9fs_issue_write() function used by the 9P network filesystem. The issue occurs when the function fails to properly update the file size metadata (i_size and remote_i_size) after writing data to a server file. If the server returns a short write due to conditions like ENOSPC, the function should adjust the file size based on the actual bytes written, but it does not, potentially leading to incorrect file size tracking.

Detection Guidance

This vulnerability is specific to the Linux kernel's 9P filesystem implementation. Detection requires checking the kernel version and verifying if the affected function v9fs_issue_write() is present. Use uname -a to check the kernel version and grep for the function in the kernel source code. If you are running a vulnerable kernel, update it immediately.

Impact Analysis

This vulnerability could lead to incorrect file size reporting, causing applications to read or write beyond the actual end of a file. This might result in data corruption, crashes, or unexpected behavior in applications using the 9P filesystem. Users relying on accurate file size information for critical operations could experience disruptions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to file size updates in the 9P protocol, which does not involve data privacy, security controls, or protected health information handling.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. This resolves the issue by correcting the v9fs_issue_write() function to properly update file sizes. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98267. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70