{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98685", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.364Z", "datePublished": "2026-10-18T15:45:53.821Z", "dateUpdated": "2026-10-19T09:23:55.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:55.472Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: discard post-EOF pagecache when extending a file via clone range\n\ncifs_remap_file_range() discarded the pagecache only for the folios\noverlapping the destination region, so when a clone extends the file the\nfolio straddling the old EOF - which may hold data dirtied past EOF\nthrough an mmap - was never dropped and became visible as file content\nonce the file was extended.\n\nStart the discard at the smaller of fstart and the old EOF. i_size is\nstill old here, so nothing past the old EOF is flushed to the server."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsfs.c"], "versions": [{"version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "lessThan": "15bb9f1d3e967e328649e92a1451e60a0dc66118", "status": "affected", "versionType": "git"}, {"version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "lessThan": "4721587f96cb8de8164f3fd203093a0875560999", "status": "affected", "versionType": "git"}, {"version": "358bd5f436d820bb758833050aae065b35d6986c", "status": "affected", "versionType": "git"}, {"version": "43801359c8971cc49b4a4db5015fba77fbd09c32", "status": "affected", "versionType": "git"}, {"version": "6.1.68", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.7", "lessThan": "6.7", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsfs.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.68"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/15bb9f1d3e967e328649e92a1451e60a0dc66118"}, {"url": "https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999"}], "title": "smb: client: discard post-EOF pagecache when extending a file via clone range", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/cifsfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "15bb9f1d3e967e328649e92a1451e60a0dc66118", "status": "affected", "version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "versionType": "git"}, {"lessThan": "4721587f96cb8de8164f3fd203093a0875560999", "status": "affected", "version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "versionType": "git"}, {"status": "affected", "version": "358bd5f436d820bb758833050aae065b35d6986c", "versionType": "git"}, {"status": "affected", "version": "43801359c8971cc49b4a4db5015fba77fbd09c32", "versionType": "git"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.68", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/cifsfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: discard post-EOF pagecache when extending a file via clone range\n\ncifs_remap_file_range() discarded the pagecache only for the folios\noverlapping the destination region, so when a clone extends the file the\nfolio straddling the old EOF - which may hold data dirtied past EOF\nthrough an mmap - was never dropped and became visible as file content\nonce the file was extended.\n\nStart the discard at the smaller of fstart and the old EOF. i_size is\nstill old here, so nothing past the old EOF is flushed to the server."}], "id": "CVE-2026-98685", "lastModified": "2026-10-19T10:19:32.923", "metrics": {}, "published": "2026-10-18T16:17:21.890", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15bb9f1d3e967e328649e92a1451e60a0dc66118"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: discard post-EOF pagecache when extending a file via clone range", "id": "2555066", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555066"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-459", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: discard post-EOF pagecache when extending a file via clone range\ncifs_remap_file_range() discarded the pagecache only for the folios\noverlapping the destination region, so when a clone extends the file the\nfolio straddling the old EOF - which may hold data dirtied past EOF\nthrough an mmap - was never dropped and became visible as file content\nonce the file was extended.\nStart the discard at the smaller of fstart and the old EOF. i_size is\nstill old here, so nothing past the old EOF is flushed to the server.", "A flaw was found in the Linux kernel's SMB client. This vulnerability can lead to information disclosure when extending a file via a clone range operation. Because the client fails to discard cached memory pages that straddle the original end-of-file boundary, data previously written past the boundary through memory mapping remains visible as valid file content. A local user could exploit this issue to expose sensitive or unintended data."], "name": "CVE-2026-98685", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98685\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98685\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98685.mbox"], "threat_severity": "Low"}