In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range… (CVE-2026-98685)

The vulnerability in the Linux kernel's SMB client implementation involved the cifs_remap_file_range() function, which discarded the pagecache only for folios overlapping the destination region. When a clone operation extended a file, the folio straddling the old EOF—potentially containing data dirtied past EOF through mmap—was not discarded. This stale data became visible as part of the file content once the file size was extended. The fix involved starting the discard at the smaller of the file start and the old EOF, ensuring that no data past the old EOF remained visible. The file size (i_size) remains old during this operation, so no data past the old EOF is flushed to the server.

This vulnerability could lead to exposure of stale or unintended data beyond the original EOF in files accessed via SMB on the Linux kernel. Such data might have been dirtied in memory but not intended to be part of the file content, potentially causing information disclosure.

A fix has been implemented in the Linux kernel to properly discard the pagecache overlapping the old EOF when extending a file via clone range. Users and administrators should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, verify the vendor advisory or Linux kernel release notes for the exact fixed versions and apply updates accordingly.