SB20261022462 - Use of uninitialized resource in Linux kernel netfs

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-98843)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause stale memory contents to be written to files, potentially disclosing sensitive information or corrupting file data.

The vulnerability exists due to use of uninitialized memory in the Linux kernel's netfs_read_gaps() function when a server read of gaps around a streaming write's dirty region returns a short response or reaches end of file. A local user can trigger file operations that encounter this condition to cause stale folio contents to be written back, potentially exposing residual data or corrupting file contents.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc
• https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705
• https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353