CVE-2026-98844

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfs: clear post-EOF pagecache when extending a file via write

Fix netfs to erase the contents of a hole created after the EOF by an

ordinary write if dirty data has been previously left there by writes

through an mmapped region. Neither the buffered nor the unbuffered/DIO

write path clears that stale pagecache.

Zero the tail of the folio straddling the EOF before an extending

write. That is the only folio that can hold data written past the EOF

through an mmap, as pages wholly beyond the EOF can't be faulted in.

The folio is zeroed rather than dropped so a concurrent extending write

can't lose data.

Both write paths downgrade the i_rwsem to shared, so extending writes

can run concurrently and the i_size read by the caller may be stale by

the time the folio is locked. Re-read i_size under the folio lock and

clamp the zeroed range up to it, so a racing write that already put

data into the folio isn't clobbered.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References