{"id":"CVE-2026-98685","kind":"vulnerability","aliases":["CVE-2026-98685"],"related":[],"title":"Linux kernel SMB client: stale pagecache data can appear after file extension","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: discard post-EOF pagecache when extending a file via clone range\n\ncifs_remap_file_range() discarded the pagecache only for the folios\noverlapping the destination region, so when a clone extends the file the\nfolio straddling the old EOF - which may hold data dirtied past EOF\nthrough an mmap - was never dropped and became visible as file content\nonce the file was extended.\n\nStart the discard at the smaller of fstart and the old EOF.  i_size is\nstill old here, so nothing past the old EOF is flushed to the server.","summary":"In the Linux kernel's SMB client, a file clone that extends a file could leave stale data from beyond the old end of file in the page cache, and that data became visible as file content after the extension. The sources do not state a confirmed attacker-controlled impact beyond this data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","kernel","linux","runtime","self-hosted","smb"],"not_affected_if":["no-cifs-mounts"],"how_to_check":"- Run `uname -r` and compare against the kernel version that contains the upstream fix, which the sources do not name.\n- Check whether CIFS/SMB mounts are in use with `mount -t cifs` or `findmnt -t cifs`.","fix":"- Update the Linux kernel to a release that includes the upstream commit for this fix; the exact version is unknown from the sources.","status":"open","published_at":"2026-10-18T16:17:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:10+00:00","updated_at":"2026-10-25T05:19:10+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:19:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for this fix; the exact version is unknown from the sources.","reach":"unknown","title":"Linux kernel SMB client: stale pagecache data can appear after file extension","impact":"low","summary":"In the Linux kernel's SMB client, a file clone that extends a file could leave stale data from beyond the old end of file in the page cache, and that data became visible as file content after the extension. The sources do not state a confirmed attacker-controlled impact beyond this data exposure.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","smb","cifs","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"stale file data from beyond old EOF becomes readable","analyst_note":"Check the NVD entry and the linked upstream kernel commit for the fixed versions, the trigger conditions and any severity score.","how_to_check":"- Run `uname -r` and compare against the kernel version that contains the upstream fix, which the sources do not name.\n- Check whether CIFS/SMB mounts are in use with `mount -t cifs` or `findmnt -t cifs`.","needs_analyst":true,"not_affected_if":["no-cifs-mounts"],"who_is_affected":"Systems running a Linux kernel with the CIFS/SMB client and mounted SMB shares that use clone range (reflink-style remap) operations on files that were modified through mmap. Systems without SMB mounts are unlikely to be affected. The sources do not give more detail.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3407,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98685':15A,18A 'appear':9A 'attack':75B 'attacker-control':74B 'becam':59B,148C 'beyond':46B,78B 'cach':55B 'cif':19B,106C 'client':4A,33B,93C 'clone':36B,104C,124C 'confirm':73B 'content':63B,152C 'control':76B 'could':41B 'cve':13A,16A 'data':7A,44B,58B,80B,137C 'destin':119C 'dirti':138C 'discard':94C,110C,160C 'drop':146C 'end':49B 'eof':97C,133C,140C,169C,181C 'exposur':81B 'extend':38B,100C,125C,157C 'extens':12A,66B 'file':11A,35B,40B,51B,62B,102C,108C,127C,151C,155C 'flush':183C 'folio':116C,129C 'follow':87C 'fstart':165C 'hold':136C 'host':25B 'impact':77B 'kernel':2A,20B,30B,85C 'leav':42B 'linux':1A,21B,29B,84C 'may':135C 'mmap':143C 'never':145C 'noth':177C 'old':48B,132C,168C,174C,180C 'overlap':117C 'page':54B 'pagecach':6A,98C,112C 'past':139C,178C 'post':96C 'post-eof':95C 'rang':105C,109C 'region':120C 'remap':107C 'resolv':91C 'runtim':22B 'self':24B 'self-host':23B 'server':186C 'size':171C 'smaller':163C 'smb':3A,26B,32B,92C 'sourc':68B 'stale':5A,43B 'start':158C 'state':71B 'still':173C 'straddl':130C 'via':103C 'visibl':60B,149C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the CIFS/SMB client and mounted SMB shares that use clone range (reflink-style remap) operations on files that were modified through mmap. Systems without SMB mounts are unlikely to be affected. The sources do not give more detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98685","severity":null,"published_at":"2026-10-18T16:17:21+00:00","modified_at":"2026-10-19T10:19:32+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}