CVE-2026-98267: 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
In the Linux kernel, the following vulnerability has been resolved:
9p: Fix v9fsissuewrite() to update isize and remoteisize
Fix v9fsissuewrite() to update isize and remoteisize to the new size of the server file if we made it larger, using the start fpos and the count returned by p9clientwrite() to calculate the new minimum file size.
This assumes that if the 9P server makes a short write (say it hits ENOSPC), a reduced count is returned.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's 9p/v9fs client to write files to a 9P server are relevant. The issue concerns writes that enlarge a server-side file, particularly when the server performs a short write.
What condition triggers the incorrect file-size handling?
The condition occurs when v9fs_issue_write() writes data that extends a file and the returned count from p9_client_write() is less than requested, such as when the server hits ENOSPC. The client may fail to update i_size and remote_i_size to reflect the size actually written.
How can administrators identify whether they may be affected?
Review whether affected hosts mount or otherwise use 9P/v9fs filesystems and perform writes to 9P servers. Short-write conditions on those filesystems, including server-side space exhaustion, are the relevant scenario.