CVE-2026-98685
Received Received - Intake

SMB Client File Extension Pagecache Exposure in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifs_remap_file_range() discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended. Start the discard at the smaller of fstart and the old EOF. i_size is still old here, so nothing past the old EOF is flushed to the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98685
EUVD
EUVD-2026-103939

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux c54fc3a4f375663f2361a9cbb2955fb4ef912879
Linux Linux c54fc3a4f375663f2361a9cbb2955fb4ef912879
Linux Linux 358bd5f436d820bb758833050aae065b35d6986c
Linux Linux 43801359c8971cc49b4a4db5015fba77fbd09c32
Linux Linux 6.1.68
Linux Linux 6.6.7
Linux Linux 6.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the SMB client incorrectly handling file extensions via clone range. When a file is extended, the system fails to discard cached data beyond the original end-of-file (EOF), potentially exposing stale or incorrect data as new file content.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS client implementation and relates to improper handling of pagecache during file cloning operations. Detection requires checking the kernel version and examining CIFS-related logs or behaviors. No direct commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to read stale data from a file after it has been extended, leading to information disclosure. This is particularly risky if sensitive data was previously stored in the file via memory-mapped operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue is specific to the Linux kernel's SMB client functionality and involves improper handling of file cache data during file extension operations. There is no indication that this vulnerability leads to unauthorized data exposure, data integrity issues, or other compliance-relevant impacts.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98685. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart