Linux Kernel CIFS EUVD-2026-76551

Requires local user access (AV:L) with at least low privileges (PR:L - a regular unprivileged user account). The system must have a CIFS/SMB share mounted and fscache/cachefilesd actively caching that share (non-default in many deployments). The attacker must be able to open a file on the CIFS mount with O_TRUNC. Exploitation is limited to Linux kernel versions in the affected ranges (6.12.105-6.13, 6.18.44-6.18.50, 7.1.8-7.2). Systems without CIFS mounts or without fscache enabled for CIFS are not affected. Physical or shell access to the target system is required - no remote network exploitation path exists.

Real-world risk is moderate. CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) correctly reflects the local, low-privilege access requirement, which substantially limits the attack surface - an attacker must already have local user access on a system that mounts CIFS/SMB shares. EPSS at 0.17% (6th percentile) and the absence of KEV listing or POC further confirm this is not being actively targeted. The C:H and I:H components are justified: confidentiality is violated because pre-truncation file contents (potentially sensitive) can be read from cache, and integrity is violated because the cache-to-disk view becomes inconsistent. The 'Information Disclosure' tag understates the impact by omitting the integrity dimension. The fix is straightforward and patches are available, making this a routine kernel update priority for systems using CIFS mounts rather than an urgent emergency.

A local user on a Linux system with a mounted CIFS share opens a file with O_TRUNC (e.g., via open(path, O_WRONLY|O_TRUNC)), triggering cifs_do_truncate() without fscache invalidation. The file's pre-truncation contents remain readable in the local fscache store, and a subsequent read by the same or another process retrieves the stale cached data rather than the now-empty file - exposing content that the application believed was securely discarded. No public POC exists; exploitation requires knowledge of fscache internals and a system with fscache configured for CIFS.