{"api_version":"1","generated_at":"2026-10-22T06:07:02+00:00","cve":"CVE-2026-98843","urls":{"html":"https://cve.report/CVE-2026-98843","api":"https://cve.report/api/cve/CVE-2026-98843.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98843","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98843"},"summary":{"title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq->transferred once ret >= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can't touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:17:38","updated_at":"2026-10-19 10:19:48"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc","name":"https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705","name":"https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353","name":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98843","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98843","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ee4cdf7ba857a894ad1650d6ab77669cbbfa329e 512eaf01ffabf4258e945016b50df5aed940b705 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ee4cdf7ba857a894ad1650d6ab77669cbbfa329e 2a62fe628a877c249c8286b157ee99d82840d9dc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ee4cdf7ba857a894ad1650d6ab77669cbbfa329e 8db55c5cd831a786a1a2a2d391aa80354535a353 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.56 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.10 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/buffered_read.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"512eaf01ffabf4258e945016b50df5aed940b705","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"},{"lessThan":"2a62fe628a877c249c8286b157ee99d82840d9dc","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"},{"lessThan":"8db55c5cd831a786a1a2a2d391aa80354535a353","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/netfs/buffered_read.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.56","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.56","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.10","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq->transferred once ret >= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can't touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront."}],"providerMetadata":{"dateUpdated":"2026-10-19T09:26:35.419Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705"},{"url":"https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc"},{"url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"}],"title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98843","datePublished":"2026-10-18T15:50:23.578Z","dateReserved":"2026-09-25T10:25:14.373Z","dateUpdated":"2026-10-19T09:26:35.419Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:17:38","lastModifiedDate":"2026-10-19 10:19:48","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98843","Ordinal":"1","Title":"netfs: zero gaps in read-gaps folio to avoid writing back stale ","CVE":"CVE-2026-98843","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98843","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq->transferred once ret >= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can't touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront.","Type":"Description","Title":"netfs: zero gaps in read-gaps folio to avoid writing back stale "}]}}}