CVE-2026-98686
kernel: smb: client: discard post-EOF pagecache when extending a file via zero range
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 18, 2026
Updated · October 22, 2026
Description
A flaw was found in the Linux kernel's SMB (Server Message Block) client. When extending a file using a zero-range operation, cached memory pages past the previous end-of-file boundary are not properly discarded. A local user can exploit this vulnerability to view stale or previously buffered data that becomes exposed as valid file content, resulting in an information disclosure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-908 · Use of Uninitialized Resource