Linux Kernel CVE-2026-98117

Requires local access to a system where the cachefiles module is in use (fscache-backed local caching for network filesystems such as NFS/AFS) AND where the cachefiles coherency tracepoint (trace_cachefiles_coherency) is enabled - the out-of-bounds read occurs only when that tracepoint fires over a coherency xattr buffer shorter than 8 bytes (including 0-length). Key limiting factors: the vector is local (AV:L), so no remote reach; enabling kernel tracepoints normally requires root/CAP_SYS_ADMIN, which likely makes the effective privilege higher than the input's PR:L; and the disclosed/corrupted window is only up to 8 bytes, bounding impact to a minor info leak or a crash rather than reliable kernel code execution.

Signals point consistently to a low-to-moderate real-world priority despite the 7.8 'High' CVSS. The supplied vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is a local, low-privilege, no-interaction flaw with full CIA impact - but that C:H/I:H/A:H triad is the generic autofill the Linux CNA applies to most kernel memory bugs and is not supported by the mechanism described here: the actual defect is trace_cachefiles_coherency() reading a fixed 8 bytes from a variable-length (possibly 0-byte) coherency buffer, i.e. an out-of-bounds/UAF read of at most 8 bytes, which realistically yields a small kernel info leak or a KASAN warning/crash rather than code execution. EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no SSVC fields are supplied; the vuln.today decision label is 'this_week' (not act_now/emergency). No exploit or PoC reference is present - only the three kernel.org fix commits and the NVD page. Note two tensions to verify: (1) the vector's C:H/I:H/A:H overstates impact versus the description's bounded 8-byte read - the true impact is closer to limited disclosure plus potential crash; (2) PR:L may itself be generous because the vulnerable tracepoint only fires when cachefiles tracing is enabled, which normally requires root/CAP_SYS_ADMIN - verify against the real trigger path before treating this as a low-privilege escalation primitive.

A local user able to exercise the cachefiles subsystem (fscache-backed caching for a network filesystem) with the cachefiles coherency tracepoint enabled causes the kernel to read 8 bytes past a short or empty coherency xattr buffer, disclosing a few bytes of adjacent kernel memory into the trace output or tripping a KASAN warning/oops. No public exploit or PoC has been identified; the only references are the upstream fix commits. The local attack vector and the requirement that kernel tracing be active make opportunistic remote or unprivileged exploitation unlikely.