HIGH Introduced in 6.12
netfs ReadGap Leak
CVE-2026-98843
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
01Description
In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfs_read_gaps() leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later got written back. Zero it after the read completes, not before: netfs_wait_for_read() returns rreq->transferred once ret >= 0, so build an iterator over the same bvec array the read used, advance past ret, and zero the rest. The dirty region already maps to sink pages in that array rather than the real folio, so this can't touch it, and only the actual shortfall gets zeroed instead of the whole gap upfront.
02KernelScan AI Analysis
Risk summary
A malicious or misbehaving network filesystem server can cause the kernel client to leak uninitialized folio contents (stale kernel memory) back to the server during writeback. Systems mounting NFS, SMB/CIFS, Ceph, AFS, or 9p shares over a network are exposed if the server sends short or EOF read responses.
Vulnerability analysis
The network filesystem buffered-read helper fails to clear the portion of a memory page that a server leaves unfilled when responding with less data than requested. That gap retains whatever data previously occupied the page — potentially sensitive contents from other files or kernel structures — and the stale data is later written back to the server during normal writeback. The fix zeroes only the actual shortfall after the read completes, using the true transfer length returned by the I/O completion. Any local user or process that can trigger reads on a mounted network filesystem (NFS, SMB, Ceph, AFS, 9p) can be affected, and a malicious server on the same network or the internet can actively exploit the flaw by sending crafted short responses.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.12 | 6.18.56 | 512eaf01ffab |
| 7.2 | 6.12 | 7.2.10 | 2a62fe628a87 |
| mainline | 6.12 | 7.3 | 8db55c5cd831 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |