CVE-2026-98843

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfs_read_gaps() leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later got written back. Zero it after the read completes, not before: netfs_wait_for_read() returns rreq->transferred once ret >= 0, so build an iterator over the same bvec array the read used, advance past ret, and zero the rest. The dirty region already maps to sink pages in that array rather than the real folio, so this can't touch it, and only the actual shortfall gets zeroed instead of the whole gap upfront.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-18 16:17:38.623000

Last modified

2026-10-19 10:19:48.390000

View original CVE JSON

{
  "id": "CVE-2026-98843",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-18T16:17:38.623",
  "lastModified": "2026-10-19T10:19:48.390",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq->transferred once ret >= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can't touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/netfs/buffered_read.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "lessThan": "512eaf01ffabf4258e945016b50df5aed940b705",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "lessThan": "2a62fe628a877c249c8286b157ee99d82840d9dc",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "lessThan": "8db55c5cd831a786a1a2a2d391aa80354535a353",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/netfs/buffered_read.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.56",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.10",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}