---
id: "CVE-2026-98685"
kind: "vulnerability"
aliases: ["CVE-2026-98685"]
title: "Linux kernel SMB client: stale pagecache data can appear after file extension"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cifs", "kernel", "linux", "runtime", "self-hosted", "smb"]
not_affected_if: ["no-cifs-mounts"]
published_at: "2026-10-18T16:17:21+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:19:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98685", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel SMB client: stale pagecache data can appear after file extension

In the Linux kernel's SMB client, a file clone that extends a file could leave stale data from beyond the old end of file in the page cache, and that data became visible as file content after the extension. The sources do not state a confirmed attacker-controlled impact beyond this data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the kernel version that contains the upstream fix, which the sources do not name.
- Check whether CIFS/SMB mounts are in use with `mount -t cifs` or `findmnt -t cifs`.

## Fix

- Update the Linux kernel to a release that includes the upstream commit for this fix; the exact version is unknown from the sources.

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98685

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

smb: client: discard post-EOF pagecache when extending a file via clone range

cifs_remap_file_range() discarded the pagecache only for the folios
overlapping the destination region, so when a clone extends the file the
folio straddling the old EOF - which may hold data dirtied past EOF
through an mmap - was never dropped and became visible as file content
once the file was extended.

Start the discard at the smaller of fstart and the old EOF.  i_size is
still old here, so nothing past the old EOF is flushed to the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_