CVE-2026-98117: cachefiles: Fix potential UAF/KASAN warning
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: Fix potential UAF/KASAN warning
Currently, tracecachefilescoherency() is being passed a pointer to a be64 lain over the coherency data in struct cachefilesxattr so that it can display the first 8 bytes. However, the data is of variable length and could even be 0 bytes. This could lead to a UAF or KASAN warning.
Fix this by making sure the buffer has room for at least 8 bytes and that those 8 bytes are pre-cleared.
Further, those bytes are not 8-byte aligned, so fix the tracepoint to extract the data as four 2-byte words (they are 2-byte aligned) and reassemble the be64. The compiler will convert this into a single 8-byte load where the CPU supports it.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The issue is associated with cachefiles coherency tracing when the coherency data is variable length and contains fewer than 8 bytes, including zero-length data. The tracepoint was passed a pointer used to display the first 8 bytes even when that much buffer space was not available.
What is the practical impact described for affected systems?
The described outcome is a potential use-after-free condition or a KASAN warning caused by reading beyond the available coherency data. The provided information does not describe privilege requirements, remote reachability, or a demonstrated code-execution impact.
What mitigation is available if an update cannot be applied immediately?
The provided data identifies the problematic path as cachefiles coherency tracing, but it does not provide a supported configuration workaround. Apply a kernel version containing one of the referenced fixes when available.