CVE-2026-98843

Status: ReceivedUnscored—

Severity—Unscored

Exploitation probability0.17 %higher than 5% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

In the Linux kernel, the following vulnerability has been resolved:

netfs: zero gaps in read-gaps folio to avoid writing back stale data

netfs_read_gaps() leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later got written back.

Zero it after the read completes, not before: netfs_wait_for_read() returns rreq->transferred once ret >= 0, so build an iterator over the same bvec array the read used, advance past ret, and zero the rest. The dirty region already maps to sink pages in that array rather than the real folio, so this can't touch it, and only the actual shortfall gets zeroed instead of the whole gap upfront.

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.17 %
Percentile among all scored CVEs: 5
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux Kernel^AI

References

Show 3 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-98843",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "lessThan": "512eaf01ffabf4258e945016b50df5aed940b705",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "lessThan": "2a62fe628a877c249c8286b157ee99d82840d9dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
              "lessThan": "8db55c5cd831a786a1a2a2d391aa80354535a353",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/netfs/buffered_read.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/netfs/buffered_read.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-18T16:17:38.623",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq->transferred once ret >= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can't touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront."
    }
  ],
  "lastModified": "2026-10-19T10:19:48.390",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}