CVE-2026-98686

What it actually does

The smb3_zero_range() function only invalidated pagecache within the explicit zeroed range; when the operation extended the file, the folio straddling the prior EOF (potentially containing mmap-dirtied data beyond EOF) was not dropped and became visible as committed file content.

Why it matters to the business

Sensitive data that existed only in process memory can become persistently stored and readable in files on SMB shares, creating an unintended information disclosure risk on any system performing file-extension operations over SMB.

How an attack unfolds

An attacker maps a region past the current EOF of an SMB file, writes chosen data into that mapping, then issues a zero-range extension that reaches or passes the mapped area; the kernel bug causes the previously private mmap data to be retained and returned on subsequent reads of the extended file.

How to fix it

Upgrade the Linux kernel to a version containing the fix that lowers the pagecache discard boundary in smb3_zero_range() to the smaller of the zero-range offset and the old EOF; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of the corrected discard logic in fs/smb/client/smb2ops.c (or equivalent) and verify that kernel builds after 2026-10-18 include the change; test by repeating an mmap-past-EOF plus zero-range extension and confirming no stale data appears.

Typical attack path

1. Mount an SMB3 share from a vulnerable Linux client
2. Open a file and extend its size via mmap writes beyond current EOF
3. Invoke fallocate(FALLOC_FL_ZERO_RANGE) or equivalent that extends the file
4. Read the newly extended region to observe the mmap-dirtied data now visible as file content

How to detect it

Examine SMB client audit logs and kernel ftrace for sequences of mmap writes followed immediately by zero-range extensions on the same file handle; correlate with subsequent read operations returning unexpected data patterns.

What your security team should do

• Apply the upstream kernel patch or distribution update within the next maintenance window
• Prioritize systems that mount SMB shares from untrusted servers
• Review SMB client usage and restrict fallocate privileges where feasible until patched