Linux Kernel CVE-2026-98125

Exploitation requires: (1) a mounted SMB3/CIFS share using the Linux kernel cifs client; (2) local access as a user able to operate on files on that mount (PR:L per the CVSS vector); (3) invoking fallocate with --insert-range (smb3_insert_range) or --collapse-range (smb3_collapse_range) where the target offset or the old EOF is NOT page-aligned, so the partially-zeroed boundary pages remain uptodate; and (4) the affected pages being present in the page cache (e.g., the file was read beforehand). Limiting factors that reduce realistic risk: the attack vector is local only (AV:L, not remote), it needs an authenticated/privileged local user on a system that actually mounts SMB shares, it needs the server-side COPYCHUNK path to move data, and the condition only arises for non-page-aligned offsets/EOF. The impact is silent stale-data readback, not code execution.

This is a medium-severity, low-priority issue in practice. The provided CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) establishes that exploitation requires local access and some privilege level (PR:L) - not remote or unauthenticated - and the EPSS score of 0.15% (4th percentile) indicates a very low probability of exploitation. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_month,' consistent with a routine patch rather than an emergency. A notable conflict exists in the input: the supplied CVSS vector scores impact as C:N/I:N/A:H (availability), yet the description and the 'Information Disclosure' tag describe silently returned stale/incorrect data on read, which is a data-integrity/correctness problem, not a denial of availability - this discrepancy should be verified against the Linux CNA record. Overall, the combination of local-only vector, authenticated access, very low EPSS, absence of KEV/POC, and a narrow trigger condition (CIFS/SMB3 mount plus a specific fallocate operation) makes this a genuinely low real-world risk despite the medium CVSS score.

A local user on a host with a mounted SMB3/CIFS share reads a file to populate (prime) the page cache, then issues an fallocate --insert-range or --collapse-range on a file whose offset or EOF is not page-aligned. Because the boundary pages are only partially zeroed and remain marked uptodate, a subsequent read returns stale cached data instead of the correct post-operation contents, silently corrupting what the application reads. No public exploit code exists; the effect is incorrect data readback rather than code execution.