CVE-2026-98843
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A Linux kernel bug could let old leftover data get saved to network files instead of the correct new data, which might leak information or corrupt files.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The flaw in netfs_read_gaps() leaves gaps around a streaming write's dirty region unread; a short or EOF server response leaves stale folio content that is later written back instead of being zeroed after the read completes.
Why it matters to the business
Risk of unintended disclosure of prior memory contents or data corruption during network filesystem write operations on Linux systems, with low immediate urgency given recent publication and minimal exploit maturity.
How an attack unfolds
An attacker positioned to influence server responses for a netfs streaming write can return a short or EOF reply, causing the kernel to write back unzeroed stale data from the gap region; the published patch corrects the timing of zeroing to only the actual shortfall after the read.
How to fix it
Apply the upstream kernel patch that zeros the shortfall after netfs_wait_for_read() succeeds rather than before, ensuring only unread gap portions are cleared.
How to confirm the fix worked
Confirm the presence of the corrected zeroing logic using an iterator over the bvec array advanced past the transferred amount; test with short/EOF responses to verify stale data is no longer written back.
Typical attack path
- Identify a Linux system performing streaming writes over netfs
- Induce or intercept a short/EOF response during gap handling
- Trigger writeback of the affected folio containing stale content
- Observe or exfiltrate the disclosed prior data
How to detect it
Examine kernel logs for netfs read-gap or writeback anomalies and inspect network filesystem traffic for unexpected short responses around streaming writes.
What your security team should do
- Monitor kernel updates for the netfs gap-zeroing fix and schedule rollout within standard maintenance windows
- Review netfs-dependent workloads for exposure to untrusted servers
- Incorporate netfs writeback behavior into routine filesystem integrity testing
The record
In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfs_read_gaps() leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later got written back. Zero it after the read completes, not before: netfs_wait_for_read() returns rreq->transferred once ret >= 0, so build an iterator over the same bvec array the read used, advance past ret, and zero the rest. The dirty region already maps to sink pages in that array rather than the real folio, so this can't touch it, and only the actual shortfall gets zeroed instead of the whole gap upfront.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|