{"id":"CVE-2026-98843","title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, s…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 512eaf01ffabf4258e945016b50df5aed940b705","Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 2a62fe628a877c249c8286b157ee99d82840d9dc","Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 8db55c5cd831a786a1a2a2d391aa80354535a353","Linux 6.12"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:50:23.578Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98843","references":[{"url":"https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705"},{"url":"https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc"},{"url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.466Z","slug":"CVE-2026-98843","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq->transferred once ret >= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can't touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront.\n\n## Affected\n\n- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 512eaf01ffabf4258e945016b50df5aed940b705`\n- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 2a62fe628a877c249c8286b157ee99d82840d9dc`\n- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 8db55c5cd831a786a1a2a2d391aa80354535a353`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}