CVE-2026-98685: smb: client: discard post-EOF pagecache when extending a file via clone range
In the Linux kernel, the following vulnerability has been resolved:
smb: client: discard post-EOF pagecache when extending a file via clone range
cifsremapfilerange() discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended.
Start the discard at the smaller of fstart and the old EOF. isize is still old here, so nothing past the old EOF is flushed to the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.117 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.61 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10
Event History
Frequently Asked Questions
What conditions are required for stale data to become visible?
The issue requires an SMB client clone-range operation that extends a file. A pagecache folio straddling the file's previous EOF must contain data dirtied past EOF through an mmap; that data can become file content after the extension.
Which systems are exposed?
The affected component is the Linux kernel SMB client. The provided information does not state whether any particular distribution, kernel version, or default configuration is affected.
How can I determine whether this may have affected data?
Review workloads that use clone-range operations to extend files over SMB and that also use mmap writes beyond a file's prior EOF. The vulnerability can cause previously post-EOF, dirty pagecache data in the EOF-straddling folio to become visible in the extended portion of the file.