---
id: CVE-2026-98685
title: 'smb: client: discard post-EOF pagecache when extending a file via clone range'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: discard post-EOF pagecache when extending a file via clone range

  cifs_remap_file_range() discarded the pagecache only for the folios
  overlapping the desti…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 <
    15bb9f1d3e967e328649e92a1451e60a0dc66118
  - >-
    Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 <
    4721587f96cb8de8164f3fd203093a0875560999
  - Linux 358bd5f436d820bb758833050aae065b35d6986c
  - Linux 43801359c8971cc49b4a4db5015fba77fbd09c32
  - Linux >= 6.1.68 < 6.2
  - Linux >= 6.6.7 < 6.7
  - Linux 6.7
published: '2026-10-18'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:23:55.472Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98685'
references:
  - url: 'https://git.kernel.org/stable/c/15bb9f1d3e967e328649e92a1451e60a0dc66118'
  - url: 'https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.528Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: discard post-EOF pagecache when extending a file via clone range

cifs_remap_file_range() discarded the pagecache only for the folios
overlapping the destination region, so when a clone extends the file the
folio straddling the old EOF - which may hold data dirtied past EOF
through an mmap - was never dropped and became visible as file content
once the file was extended.

Start the discard at the smaller of fstart and the old EOF.  i_size is
still old here, so nothing past the old EOF is flushed to the server.

## Affected

- `Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 < 15bb9f1d3e967e328649e92a1451e60a0dc66118`
- `Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 < 4721587f96cb8de8164f3fd203093a0875560999`
- `Linux 358bd5f436d820bb758833050aae065b35d6986c`
- `Linux 43801359c8971cc49b4a4db5015fba77fbd09c32`
- `Linux >= 6.1.68 < 6.2`
- `Linux >= 6.6.7 < 6.7`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.