From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBE863A48C8 for ; Sun, 18 Oct 2026 15:49:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792338557; cv=none; b=WZtsxCycCQgbixB83t73EypLS0wmus9FECdmicC621EpwVI1QgL6uV0+VWKr/YB4Uxjbv0as1ojdK3wQDfv8jVS0ckhEA3eetG/1/A1dje4yoRCW+ryjYA4VIs/ADD0kBAmdlPNTDhQ0N64XvOwaSc9iroNKA7Y+2fWjVNrIHUc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792338557; c=relaxed/simple; bh=5QheO40n98GNjxlorFa7+d0lWt+V855xQMKTHIZIeZY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=WGSVN7VsqofGGCDpIlpj1QwHy0mf+U+z+HVvURMEfVFLS3DOfdoea0ZQbdZb6giHgN/waJ2nrCaps5I9pnfAgt9DN8eq7M6tyswz6ubwZQ2Rx895iAvVKu3HEsjBeuYZUCxNxt/j+Ux/HR7ptKwGLpEw/HykkbLMMxmJKQfTLQk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Uu027RfE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Uu027RfE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ACDD51F000C4; Sun, 18 Oct 2026 15:49:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792338556; bh=z8IHI3oA60NhJFywukoCS9BS8Ak1jcIZIJz8i9V8qIw=; h=From:To:Cc:Subject:Date:Reply-To; b=Uu027RfEOSdvVT7YYMsU9+txu5dVbLnlfaeceyIxhBMy5qDU/W7ZpdZN2OvDsWYWA BNXI6G7EdbDPg2ap3jQTZbwIkzgV0kqyTbNTHUZhl4pm/XeivIS1bHO3Rvv3nQH60L 3IXZCMLbmOrDIRNFh4zaD4Cum+oVUEe2l1ogyUSI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98686: smb: client: discard post-EOF pagecache when extending a file via zero range Date: Sun, 18 Oct 2026 17:44:21 +0200 Message-ID: <2026101802-CVE-2026-98686-7aca@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2603; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=dWzYZ7CrAoew2oIkezeVUaZOPkyx0HIhZvWbgJ6n8Gc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXXjrNU4/g+3NaWMtwB6N6yIaYfYtnGj+V5mo5o5tmX Sil43evI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZy3JJhwYV/R75+/aa/eLPE tbaJ9vb7cuq4shnmx4s4l+61b9h7jZ3Nmn+Ww8t18/02AgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3_zero_range() removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended. Lower the discard boundary to the smaller of the zero-range offset and the old EOF. The Linux kernel CVE team has assigned CVE-2026-98686 to this issue. Affected and fixed versions =========================== Issue introduced in 5.1 with commit 72c419d9b073628d3b5b0b2fc787b724f1a8c726 and fixed in 6.12.113 with commit 94949b6b2f2bf0dba2e8786aed0b08cc6bc3a183 Issue introduced in 5.1 with commit 72c419d9b073628d3b5b0b2fc787b724f1a8c726 and fixed in 6.18.56 with commit b75dadb50a25eed525264bf6fea44fad94e7626f Issue introduced in 5.1 with commit 72c419d9b073628d3b5b0b2fc787b724f1a8c726 and fixed in 7.2.10 with commit 6a8279c98ad289b27c0bdb11adb3f0c0b7fd456d Issue introduced in 5.1 with commit 72c419d9b073628d3b5b0b2fc787b724f1a8c726 and fixed in 7.3-rc6 with commit da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98686 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/smb/client/smb2ops.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/94949b6b2f2bf0dba2e8786aed0b08cc6bc3a183 https://git.kernel.org/stable/c/b75dadb50a25eed525264bf6fea44fad94e7626f https://git.kernel.org/stable/c/6a8279c98ad289b27c0bdb11adb3f0c0b7fd456d https://git.kernel.org/stable/c/da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0