{"id":"CVE-2026-98686","kind":"vulnerability","aliases":["CVE-2026-98686"],"related":[],"title":"Linux kernel SMB client: stale pagecache data exposed after file extension","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: discard post-EOF pagecache when extending a file via zero range\n\nsmb3_zero_range() removed the pagecache only for the range being zeroed,\nso when it extends the file the folio straddling the old EOF - which may\nhold data dirtied past EOF through an mmap - was never dropped and became\nvisible as file content once the file was extended.\n\nLower the discard boundary to the smaller of the zero-range offset and the\nold EOF.","summary":"When the Linux kernel's SMB client extends a file using zero-range, it leaves pagecache data dirtied past the old end of file in place, so that data becomes visible as file content. The sources describe a data exposure from stale cached pages and do not state an attacker-controlled trigger.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","kernel","linux","runtime","self-hosted","smb"],"not_affected_if":["cifs-module-not-loaded","no-smb-mounts"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the NVD entry (unknown in the sources).\n- Check whether the SMB client module is loaded with `lsmod | grep cifs`.","fix":"- Update the Linux kernel to a release that includes the upstream commit for smb: client: discard post-EOF pagecache when extending a file via zero range (version unknown in the sources).","status":"open","published_at":"2026-10-18T16:17:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:09+00:00","updated_at":"2026-10-25T05:19:09+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:19:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for smb: client: discard post-EOF pagecache when extending a file via zero range (version unknown in the sources).","reach":"network","title":"Linux kernel SMB client: stale pagecache data exposed after file extension","impact":"low","summary":"When the Linux kernel's SMB client extends a file using zero-range, it leaves pagecache data dirtied past the old end of file in place, so that data becomes visible as file content. The sources describe a data exposure from stale cached pages and do not state an attacker-controlled trigger.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","smb","cifs","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"stale file data from past EOF becomes readable as file content","analyst_note":"Confirm the fixed kernel versions and the upstream commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98686 and whether an unprivileged attacker can trigger it remotely.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the NVD entry (unknown in the sources).\n- Check whether the SMB client module is loaded with `lsmod | grep cifs`.","needs_analyst":true,"not_affected_if":["no-smb-mounts","cifs-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the CIFS/SMB3 client that mount SMB shares and use zero-range file extension on files that are also mapped with mmap. Hosts that do not mount SMB shares are unlikely to be affected. Systems without the cifs module loaded can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000659,"input_tokens":3378,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98686':14A,17A 'attack':77B 'attacker-control':76B 'becam':142C 'becom':56B 'boundari':155C 'cach':69B 'cif':18B 'client':4A,32B,91C 'content':60B,146C 'control':78B 'cve':12A,15A 'data':7A,43B,55B,65B,131C 'describ':63B 'dirti':44B,132C 'discard':92C,154C 'drop':140C 'end':48B 'eof':95C,127C,134C,168C 'expos':8A 'exposur':66B 'extend':33B,98C,119C,151C 'extens':11A 'file':10A,35B,50B,59B,100C,121C,145C,149C 'folio':123C 'follow':85C 'hold':130C 'host':24B 'kernel':2A,19B,29B,83C 'leav':41B 'linux':1A,20B,28B,82C 'lower':152C 'may':129C 'mmap':137C 'never':139C 'offset':164C 'old':47B,126C,167C 'page':70B 'pagecach':6A,42B,96C,109C 'past':45B,133C 'place':52B 'post':94C 'post-eof':93C 'rang':39B,103C,106C,113C,163C 'remov':107C 'resolv':89C 'runtim':21B 'self':23B 'self-host':22B 'smaller':158C 'smb':3A,25B,31B,90C 'smb3':104C 'sourc':62B 'stale':5A,68B 'state':74B 'straddl':124C 'trigger':79B 'use':36B 'via':101C 'visibl':57B,143C 'vulner':86C 'zero':38B,102C,105C,115C,162C 'zero-rang':37B,161C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the CIFS/SMB3 client that mount SMB shares and use zero-range file extension on files that are also mapped with mmap. Hosts that do not mount SMB shares are unlikely to be affected. Systems without the cifs module loaded can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98686","severity":null,"published_at":"2026-10-18T16:17:21+00:00","modified_at":"2026-10-21T13:21:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}