---
id: CVE-2026-98843
title: 'netfs: zero gaps in read-gaps folio to avoid writing back stale data'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfs: zero gaps in read-gaps folio to avoid writing back stale data

  netfs_read_gaps() leaves gaps around a streaming write's dirty region
  unread on the server side, s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e <
    512eaf01ffabf4258e945016b50df5aed940b705
  - >-
    Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e <
    2a62fe628a877c249c8286b157ee99d82840d9dc
  - >-
    Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e <
    8db55c5cd831a786a1a2a2d391aa80354535a353
  - Linux 6.12
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:50:23.578Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98843'
references:
  - url: 'https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705'
  - url: 'https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc'
  - url: 'https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.466Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfs: zero gaps in read-gaps folio to avoid writing back stale data

netfs_read_gaps() leaves gaps around a streaming write's dirty region
unread on the server side, so a short/EOF response there left stale
folio content that later got written back.

Zero it after the read completes, not before: netfs_wait_for_read()
returns rreq->transferred once ret >= 0, so build an iterator over the
same bvec array the read used, advance past ret, and zero the rest.
The dirty region already maps to sink pages in that array rather than
the real folio, so this can't touch it, and only the actual shortfall
gets zeroed instead of the whole gap upfront.

## Affected

- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 512eaf01ffabf4258e945016b50df5aed940b705`
- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 2a62fe628a877c249c8286b157ee99d82840d9dc`
- `Linux >= ee4cdf7ba857a894ad1650d6ab77669cbbfa329e < 8db55c5cd831a786a1a2a2d391aa80354535a353`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.