EUVD-2026-86956
GHSA-mgrf-j38j-q2mg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access to CIFS/SMB3 mount
-
ExploitPrime page cache by reading file
-
ExecutionRun fallocate insert/collapse with unaligned offset
-
ImpactRead back stale cached data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
|
| Exploitation Conditions | Exploitation requires: (1) a mounted SMB3/CIFS share using the Linux kernel cifs client; (2) local access as a user able to operate on files on that mount (PR:L per the CVSS vector); (3) invoking fallocate with --insert-range (smb3_insert_range) or --collapse-range (smb3_collapse_range) where the target offset or the old EOF is NOT page-aligned, so the partially-zeroed boundary pages remain uptodate; and (4) the affected pages being present in the page cache (e.g., the file was read beforehand). Limiting factors that reduce realistic risk: the attack vector is local only (AV:L, not remote), it needs an authenticated/privileged local user on a system that actually mounts SMB shares, it needs the server-side COPYCHUNK path to move data, and the condition only arises for non-page-aligned offsets/EOF. The impact is silent stale-data readback, not code execution. |
| Impact | This is a medium-severity, low-priority issue in practice. The provided CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) establishes that exploitation requires local access and some privilege level (PR:L) - not remote or unauthenticated - and the EPSS score of 0.15% (4th percentile) indicates a very low probability of exploitation. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_month,' consistent with a routine patch rather than an emergency. A notable conflict exists in the input: the supplied CVSS vector scores impact as C:N/I:N/A:H (availability), yet the description and the 'Information Disclosure' tag describe silently returned stale/incorrect data on read, which is a data-integrity/correctness problem, not a denial of availability - this discrepancy should be verified against the Linux CNA record. Overall, the combination of local-only vector, authenticated access, very low EPSS, absence of KEV/POC, and a narrow trigger condition (CIFS/SMB3 mount plus a specific fallocate operation) makes this a genuinely low real-world risk despite the medium CVSS score. |
| Exploit ScenarioDerived | A local user on a host with a mounted SMB3/CIFS share reads a file to populate (prime) the page cache, then issues an fallocate --insert-range or --collapse-range on a file whose offset or EOF is not page-aligned. Because the boundary pages are only partially zeroed and remain marked uptodate, a subsequent read returns stale cached data instead of the correct post-operation contents, silently corrupting what the application reads. No public exploit code exists; the effect is incorrect data readback rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
The Linux kernel CIFS/SMB client can return stale data after a successful insert-range or collapse-range operation on an SMB3 mounted file. smb3_insert_range() and smb3_collapse_range() invalidate the page cache with truncate_pagecache_range(), but when the target offset or old EOF is not page-aligned, the boundary pages are only partially zeroed and remain uptodate, so the client may serve stale contents. Affected are Linux kernels with the smb/client insert/collapse range support (versions cited from 5.19.12 through 7.2.x, fixed in 7.2.7 and 7.3-rc2); exploitation requires local access on a system that mounts an SMB3/CIFS share and it yields silent stale-data readback rather than code execution. No public exploit was identified at time of analysis, EPSS is low (0.15%), and the issue is not in CISA KEV.
RemediationAI
Apply the upstream kernel fixes: update to Linux 7.2.7 or 7.3-rc2, or take the stable backports referenced at https://git.kernel.org/stable/c/76222e76d08fbae4092ee9da84ded2b4c24ee598, https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032 and https://git.kernel.org/stable/c/52dd721b3de57e41261e08485b2bc62b22b80ebe from your distribution vendor; patched kernel packages are available per vendor advisory (EUVD-2026-86956 / NVD reference). Because the trigger requires a local user operating on an SMB3/CIFS mount, interim risk reduction consists of restricting who can write to CIFS mounts and avoiding non-page-aligned fallocate insert-range or collapse-range operations on such mounts, at the cost of reduced functionality and only partial protection. A public PoC reference exists in the form of a reproducer script in the commit message; it is not verified as working exploit code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is in the Linux kernel SMB3 client implementation (fs/smb/client), which backs CIFS/SMB-mounted filesystems. When userspace issues fallocate with FALLOC_FL_INSERT_RANGE or FALLOC_FL_COLLAPSE_RANGE, smb3_insert_range() and smb3_collapse_range() move data on the server via COPYCHUNK and then invalidate the local page cache using truncate_pagecache_range(). That helper only invalidates fully covered pages, so when the start offset or the previous EOF is not page-aligned, the boundary pages remain marked uptodate while their contents are only partially zeroed; subsequent reads can therefore return stale bytes. The CVE is classified as CWE-669 (Incorrect Resource Transfer Between Spheres), reflecting that page-cache state is not correctly synchronized with the server-side data movement rather than a memory-safety defect. Any process with local access and write privileges on an SMB3 mount can trigger the condition by invoking insert-range or collapse-range with non-page-aligned offsets on a file whose pages are already cached, so impact is limited to silent data-integrity/reliability errors in the client's cached view. The trigger is fully described by the kernel commit message; no remote vector is involved.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Requires local access to a CIFS mount and ability to run fallocate (AV:L, PR:L, AC:L); the resulting impact is silently returned stale/incorrect data, a data-integrity failure (I:H), not availability loss or cross-sphere disclosure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix stale page cache in insert/collapse range
smb3_insert_range() and smb3_collapse_range() use truncate_pagecache_range() to invalidate the affected page cache. However, if off or old_eof is not page-aligned, the boundary pages are only partially zeroed and remain uptodate. As a result, the client may return stale data after a successful insert/collapse range operation.
For example, with 4K pages:
page 0 page 1 page 2 0------4K 4K------8K 8K------12K ^ ^ off=2K old_eof=10K
Page 1 is removed from the page cache, while the boundary pages are only partially zeroed. After COPYCHUNK moves the data on the server, these cached pages may still return stale data.
This can be reproduced on a CIFS mount:
bash -c ' FILE=/mnt/scratch/repro
Use a 6 KiB file so EOF is not page-aligned.
dd if=/dev/urandom of=/tmp/src bs=1K count=6 status=none
Expected: a 4 KiB hole followed by the original data.
rm -f /tmp/expected truncate -s 4K /tmp/expected cat /tmp/src >> /tmp/expected
cp /tmp/src "$FILE"
Prime the page cache before moving data on the server.
cat "$FILE" > /dev/null
fallocate --insert-range -o 0 -l 4K "$FILE"
if cmp -s /tmp/expected "$FILE"; then echo "readback: OK" else echo "readback: STALE DATA" fi '
Fix this by writing back dirty data and discarding the page cache from the start of the page containing off to EOF before moving data on the server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB