Expected behavior violation in Linux kernel - CVE-2026-98267

Vulnerability details

The vulnerability allows a local user to cause file size metadata to become inconsistent with the server file size.

The vulnerability exists due to a failure to update local and remote file size metadata in v9fs_issue_write() in the Linux kernel 9p filesystem when writing data that extends a server file. A local user can write data beyond the previously recorded file size to cause file size metadata to become inconsistent with the server file size.

Affected software

How to mitigate CVE-2026-98267

External References

• https://git.kernel.org/stable/c/88871ab548c1d7b11cde9b04063f3c1c6fbd7039
• https://git.kernel.org/stable/c/9cd92e3392bdd14568e9e44aec1ac05e1fcd62e5
• https://git.kernel.org/stable/c/aeb1fe55583836744aef11fbfa2a09122aa9816c
• https://git.kernel.org/stable/c/c60ae98c5aa64021751b38ab1313b19d620bf640

Related Security Bulletins

• Expected behavior violation in Linux kernel 9p
• Debian update for linux