SB2026100794 - Expected behavior violation in Linux kernel 9p

Description

This security bulletin contains information about 1 vulnerability.

1) Expected behavior violation (CVE-ID: CVE-2026-98267)

CWE-ID: CWE-440 - Expected Behavior Violation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause file size metadata to become inconsistent with the server file size.

The vulnerability exists due to a failure to update local and remote file size metadata in v9fs_issue_write() in the Linux kernel 9p filesystem when writing data that extends a server file. A local user can write data beyond the previously recorded file size to cause file size metadata to become inconsistent with the server file size.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/88871ab548c1d7b11cde9b04063f3c1c6fbd7039
• https://git.kernel.org/stable/c/9cd92e3392bdd14568e9e44aec1ac05e1fcd62e5
• https://git.kernel.org/stable/c/aeb1fe55583836744aef11fbfa2a09122aa9816c
• https://git.kernel.org/stable/c/c60ae98c5aa64021751b38ab1313b19d620bf640