CVE-2026-92487

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix valid_size extension over a shared writable mapping

When a shared writable mapping has its valid_size extended by a buffered

write or a page fault, exfat zeroes the page-cache gap below the new

valid_size. A store through the mapping can race with this zeroing and be

overwritten.

Fix this by zeroing the gap lazily. Drop ->map_pages so that every first

write fault goes through exfat_page_mkwrite(), which advances valid_size to

cover the faulting page. With fault-around enabled, a store could install a

writable PTE, skip ->page_mkwrite(), and land past valid_size without

advancing it. Extending valid_size one faulting page at a time also leaves

never-written pages in a large mapping alone.

The gap is filled with block granularity, zeroing only the not-uptodate

blocks and preserving blocks that may hold data stored through the mapping.

On the buffered-write path the invalidate lock is held and the gap is

un

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References