---
id: CVE-2026-98686
title: 'smb: client: discard post-EOF pagecache when extending a file via zero range'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: discard post-EOF pagecache when extending a file via zero range

  smb3_zero_range() removed the pagecache only for the range being zeroed,
  so when it extend…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    94949b6b2f2bf0dba2e8786aed0b08cc6bc3a183
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    b75dadb50a25eed525264bf6fea44fad94e7626f
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    6a8279c98ad289b27c0bdb11adb3f0c0b7fd456d
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0
  - Linux 5.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:45:55.193Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98686'
references:
  - url: 'https://git.kernel.org/stable/c/94949b6b2f2bf0dba2e8786aed0b08cc6bc3a183'
  - url: 'https://git.kernel.org/stable/c/b75dadb50a25eed525264bf6fea44fad94e7626f'
  - url: 'https://git.kernel.org/stable/c/6a8279c98ad289b27c0bdb11adb3f0c0b7fd456d'
  - url: 'https://git.kernel.org/stable/c/da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.519Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: discard post-EOF pagecache when extending a file via zero range

smb3_zero_range() removed the pagecache only for the range being zeroed,
so when it extends the file the folio straddling the old EOF - which may
hold data dirtied past EOF through an mmap - was never dropped and became
visible as file content once the file was extended.

Lower the discard boundary to the smaller of the zero-range offset and the
old EOF.

## Affected

- `Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 < 94949b6b2f2bf0dba2e8786aed0b08cc6bc3a183`
- `Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 < b75dadb50a25eed525264bf6fea44fad94e7626f`
- `Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 < 6a8279c98ad289b27c0bdb11adb3f0c0b7fd456d`
- `Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 < da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0`
- `Linux 5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.