CVE-2026-98843
Received Received - Intake

Linux Kernel Memory Corruption in netfs Read-Gaps

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfs_read_gaps() leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later got written back. Zero it after the read completes, not before: netfs_wait_for_read() returns rreq->transferred once ret >= 0, so build an iterator over the same bvec array the read used, advance past ret, and zero the rest. The dirty region already maps to sink pages in that array rather than the real folio, so this can't touch it, and only the actual shortfall gets zeroed instead of the whole gap upfront.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98843
EUVD
EUVD-2026-103783

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux ee4cdf7ba857a894ad1650d6ab77669cbbfa329e
Linux Linux ee4cdf7ba857a894ad1650d6ab77669cbbfa329e
Linux Linux ee4cdf7ba857a894ad1650d6ab77669cbbfa329e
Linux Linux 6.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the netfs subsystem where read-gaps are not properly zeroed after a read operation. This can lead to stale data being written back to storage, potentially exposing sensitive information or causing data corruption.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read stale data from memory that was previously written but not properly cleared. This might lead to unauthorized access to sensitive information or corruption of data being processed by the system.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Organizations using affected Linux kernel versions may face legal and regulatory penalties due to potential data breaches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart