CVE-2026-98686 smb: client: discard post-EOF pagecache when extending a file via zero range
A local attacker can read stale pagecache data beyond the end of a file when extending it via SMB zero range operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98686?
CVE-2026-98686 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: discard post-EOF pagecache when extending a file via zero range
smb3_zero_range() removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended.
Lower the discard boundary to the smaller of the zero-range offset and the old EOF.
Which versions are affected by CVE-2026-98686?
How do I fix CVE-2026-98686?
Apply the vendor's patch.
Is CVE-2026-98686 being exploited?
There is no known exploitation of CVE-2026-98686 in the wild and no public exploit code.
Sources
Also known as AZL-109121, BELL-CVE-2026-98686, DEBIAN-CVE-2026-98686, GHSA-826x-h445-jqcg, UBUNTU-CVE-2026-98686.