{"id":"CVE-2026-98843","kind":"vulnerability","aliases":["CVE-2026-98843"],"related":[],"title":"Linux kernel netfs: stale folio data can be written back to disk","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq->transferred once ret >= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can't touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront.","summary":"In the Linux kernel's netfs layer, gaps around a streaming write's dirty region were left unread, so a short or end-of-file server response could leave stale folio content. That stale content could then be written back, so data in the page cache may be corrupted or leak old contents.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","netfs","network-filesystems","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:38+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:08+00:00","updated_at":"2026-10-25T05:13:08+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:13:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel netfs: stale folio data can be written back to disk","impact":"medium","summary":"In the Linux kernel's netfs layer, gaps around a streaming write's dirty region were left unread, so a short or end-of-file server response could leave stale folio content. That stale content could then be written back, so data in the page cache may be corrupted or leak old contents.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","network-filesystems","netfs"],"confidence":0.4,"needs_auth":"unknown","worst_case":"stale file data written back to server storage","analyst_note":"Find the kernel stable backport commits and affected version ranges for CVE-2026-98843 in the NVD entry, and check which filesystems use netfs (for example CIFS, NFS, Ceph, 9p) to say who is exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00054,"input_tokens":3460,"output_tokens":387,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98843':15A,18A '0':152C 'actual':197C 'advanc':165C 'alreadi':175C 'around':34B,109C 'array':161C,182C 'avoid':99C 'back':10A,66B,101C,134C 'build':154C 'bvec':160C 'cach':72B 'complet':140C 'content':58B,61B,79B,129C 'corrupt':75B 'could':54B,62B 'cve':13A,16A 'data':6A,68B,103C 'dirti':39B,114C,173C 'disk':12A 'end':49B 'end-of-fil':48B 'file':51B 'filesystem':24B 'folio':5A,57B,97C,128C,187C 'follow':85C 'gap':33B,92C,96C,106C,108C,205C 'get':199C 'got':132C 'instead':201C 'iter':156C 'kernel':2A,19B,29B,83C 'later':131C 'layer':32B 'leak':77B 'leav':55B,107C 'left':42B,126C 'linux':1A,20B,28B,82C 'map':176C 'may':73B 'netf':3A,21B,31B,90C,104C,143C 'network':23B 'network-filesystem':22B 'old':78B 'page':71B,179C 'past':166C 'rather':183C 'read':95C,105C,139C,146C,163C 'read-gap':94C 'real':186C 'region':40B,115C,174C 'resolv':89C 'respons':53B,124C 'rest':171C 'ret':151C,167C 'return':147C 'rreq':148C 'runtim':25B 'server':52B,119C 'short':46B 'short/eof':123C 'shortfal':198C 'side':120C 'sink':178C 'stale':4A,56B,60B,102C,127C 'stream':36B,111C 'touch':192C 'transfer':149C 'unread':43B,116C 'upfront':206C 'use':164C 'vulner':86C 'wait':144C 'whole':204C 'write':37B,100C,112C 'written':9A,65B,133C 'zero':91C,135C,169C,200C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98843","severity":null,"published_at":"2026-10-18T16:17:38+00:00","modified_at":"2026-10-19T10:19:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}