EUVD-2026-86955
GHSA-wcf3-p4hx-gg65
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access to fscache-enabled SMB mount
-
ExploitPerform fallocate range operation on cached file
-
ImpactSubsequent read returns stale FS-Cache data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Operation on resource after expiration or release
|
| Exploitation Conditions | Exploitation requires a very specific deployment of the Linux CIFS/SMB client: a mount using FS-Cache (the 'fsc' mount option) backed by an active CacheFiles backend, a file whose data has been populated into FS-Cache and whose page cache has since been dropped, and a local user able to invoke a fallocate range operation (zero-range, punch-hole, insert-range, or collapse-range) on that file. The limiting factors that reduce real risk: the vector is local (AV:L), not remote; FS-Cache ('fsc') on CIFS is a non-default, infrequently enabled configuration; and the affected fallocate paths require write access to the target file. These conditions make the realistic exposure far narrower than the ubiquity of the Linux kernel itself would suggest. |
| Impact | This is a genuinely low-priority issue despite the 5.5 (MEDIUM) base score, and the signals are consistent in pointing that way. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H describes a local-only vulnerability (AV:L) requiring some privilege (PR:L) with no user interaction - not a remotely reachable flaw. EPSS is very low at 0.16% (4th percentile), there is no CISA KEV listing, and the vuln.today decision label is 'this_month' rather than act_now/emergency, so none of the exploitation-urgency signals are elevated. There is a notable internal conflict in the impact metrics: NVD scores this A:H (high availability impact) with C:N/I:N, yet the mechanism described - FS-Cache serving stale pre-operation page data after a server-side fallocate range operation - and the vendor Tags ('Information Disclosure') describe a cache-coherency / data-correctness problem, not a denial of service. The A:H rating appears to overstate and mischaracterize the real impact, which is a reader receiving stale data; verify the impact classification with NVD/vendor. Net: real-world risk is low - local vector, non-default configuration prerequisites, low EPSS, no known exploitation - this is a correctness/data-integrity fix rather than an urgent security emergency. |
| Exploit ScenarioDerived | A local user on a Linux host with a CIFS/SMB share mounted using FS-Cache (the 'fsc' mount option) and an active CacheFiles backend performs a fallocate range operation (zero-range, punch-hole, insert-range, or collapse-range) on a file whose contents are already cached. Because the FS-Cache cookie is left valid, a later read returns stale pre-operation data instead of the modified file contents. The CVE description includes a working reproducer script that demonstrates the stale readback; however, no weaponized exploit or external PoC reference is provided, and the attack vector is local (AV:L), not remote. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Stale-data reads in the Linux kernel CIFS/SMB client let a local user with write access to a cached file retrieve pre-modification contents after a fallocate range operation has already rewritten that range on the server. The four affected paths - smb3_zero_range(), smb3_punch_hole(), smb3_insert_range() and smb3_collapse_range() - discard the affected page cache but leave the FS-Cache cookie valid, so a later read can be served from persistent cache instead of the server; the flaw only manifests on a CIFS mount that uses the non-default 'fsc' mount option with an active CacheFiles backend, which keeps realistic exposure narrow even though the kernel itself is ubiquitous. A reproducer script is included in the upstream commit message; it is not verified as working exploit code, EPSS is 0.16% (4th percentile), and there is no CISA KEV listing, so no public exploit beyond that reference was identified at time of analysis.
RemediationAI
Vendor-released patch: update to Linux 7.2.7 or 7.3-rc2, or apply the corresponding stable backport identified by commit 93c6e5a8d7c5071d586c1411596d5db5faad22b2 or 448ba0ae65ca61064183564d2983c9aa59bd6ba7 (see https://git.kernel.org/stable/c/93c6e5a8d7c5071d586c1411596d5db5faad22b2 and https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7). Where an immediate kernel update is not possible, the effective compensating control is to stop using persistent caching on CIFS mounts: remount or reconfigure the share without the 'fsc' mount option, which eliminates the stale-cookie path entirely at the cost of losing cache persistence across mounts and page-cache eviction, with a corresponding read-performance penalty for repeated access to the same files. Restricting which local users can write to fsc-mounted files also removes the prerequisite of invoking a fallocate range operation on a cached file, though it does not fix the underlying defect and may disrupt legitimate write workflows. Because the assessed impact is limited to disclosure of stale file contents on a non-default configuration, remediation can be scheduled with the monthly kernel update cycle rather than treated as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Linux CIFS/SMB client can persist file data in FS-Cache, the kernel's general caching layer, backed by CacheFiles on a local disk so that reads survive across mounts and page-cache eviction. Coherence between the volatile page cache and that persistent cache is maintained through FS-Cache cookies: whenever file contents change, the client must invalidate the cookie for the affected range so that stale blocks are never re-served. The four range-manipulation helpers smb3_zero_range(), smb3_punch_hole(), smb3_insert_range() and smb3_collapse_range() perform the modification server-side and correctly drop the affected page cache, but they do not invalidate the corresponding FS-Cache cookie, which is a CWE-672 (operation on a resource after expiration or release) class defect - the cached resource outlives the invalidation event and is subsequently consumed. The upstream fix reorders the operation so that FS-Cache is invalidated after outstanding I/O has completed and before the file is modified on the server, closing the window in which a reader could be handed pre-modification data. The trigger is demonstrated by a script in the commit message that populates FS-Cache, forces page-cache eviction via /proc/sys/vm/drop_caches, issues fallocate --zero-range, and compares the readback against the expected contents; the reproduction setup itself requires root on the client to create the mount and write drop_caches, while the vulnerable operation needs only write access to the target file. Affected builds are tracked as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local fscache-enabled CIFS mount and file write access give AV:L/AC:L/PR:L; stale cached data read is a limited information-exposure issue, so C:L with no integrity or availability (DoS) impact - unlike NVD's A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
smb/client: invalidate fscache for fallocate range operations
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() modify file contents through server-side range operations. These operations discard the affected page cache, but leave the FS-Cache cookie valid, so a later read may return data cached before the range operation.
Fix this by invalidating FS-Cache after outstanding I/O has completed and before modifying the file on the server.
Run the following as root on a CIFS mount with fsc enabled and an active CacheFiles backend:
bash -c ' MNT=/mnt/cifs FILE="$MNT/repro"
Generate four 1 MiB random blocks: [A][B][C][D].
dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none
Expected contents after zeroing B: [A][zero][C][D].
cp /tmp/src /tmp/expected dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \ conv=notrunc status=none cp /tmp/src "$FILE"
Populate FS-Cache, then discard the page cache.
sync echo 1 > /proc/sys/vm/drop_caches cat "$FILE" > /dev/null sync echo 1 > /proc/sys/vm/drop_caches
fallocate --zero-range -o 1M -l 1M "$FILE"
if cmp -s /tmp/expected "$FILE"; then echo "readback: OK" else echo "readback: STALE DATA" fi '
Before this change, the readback differs from /tmp/expected:
readback: STALE DATA
After this change, it matches:
readback: OK
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB