CVE-2026-98125
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix stale page cache in insert/collapse range
smb3_insert_range() and smb3_collapse_range() use truncate_pagecache_range() to invalidate the affected page cache. However, if off or old_eof is not page-aligned, the boundary pages are only partially zeroed and remain uptodate. As a result, the client may return stale data after a successful insert/collapse range operation.
For example, with 4K pages:
Page 1 is removed from the page cache, while the boundary pages are only partially zeroed. After COPYCHUNK moves the data on the server, these cached pages may still return stale data.
Leer descripción completaMostrar menos
This can be reproduced on a CIFS mount:
Fix this by writing back dirty data and discarding the page cache from the start of the page containing off to EOF before moving data on the server.
Detalles técnicos trazas, registros y código del informe original
page 0 page 1 page 2
0------4K 4K------8K 8K------12K
^ ^
off=2K old_eof=10K
bash -c '
FILE=/mnt/scratch/repro
# Use a 6 KiB file so EOF is not page-aligned.
dd if=/dev/urandom of=/tmp/src bs=1K count=6 status=none
# Expected: a 4 KiB hole followed by the original data.
rm -f /tmp/expected
truncate -s 4K /tmp/expected
cat /tmp/src >> /tmp/expected
cp /tmp/src "$FILE"
# Prime the page cache before moving data on the server.
cat "$FILE" > /dev/null
fallocate --insert-range -o 0 -l 4K "$FILE"
if cmp -s /tmp/expected "$FILE"; then
echo "readback: OK"
else
echo "readback: STALE DATA"
fi
'CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.15%
- Percentil entre todas las CVEs puntuadas: 4
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98125",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fa30a81f255a56cccd89552cd6ce7ea6e8d8acc4",
"lessThan": "76222e76d08fbae4092ee9da84ded2b4c24ee598",
"versionType": "git"
},
{
"status": "affected",
"version": "fa30a81f255a56cccd89552cd6ce7ea6e8d8acc4",
"lessThan": "01261a6fa48b62f5ead8e88aaca1e27cb9ab9032",
"versionType": "git"
},
{
"status": "affected",
"version": "49523a4732204bdacbf3941a016503ddb4ddb3b9",
"versionType": "git"
},
{
"status": "affected",
"version": "0cdde8460c304283d4ebe3f767a70215d1ab9d4e",
"versionType": "git"
},
{
"status": "affected",
"version": "5.19.12",
"lessThan": "5.20",
"versionType": "semver"
}
],
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-25T11:17:43.827",
"references": [
{
"url": "https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/76222e76d08fbae4092ee9da84ded2b4c24ee598",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix stale page cache in insert/collapse range\n\nsmb3_insert_range() and smb3_collapse_range() use\ntruncate_pagecache_range() to invalidate the affected page cache.\nHowever, if off or old_eof is not page-aligned, the boundary pages are\nonly partially zeroed and remain uptodate. As a result, the client may\nreturn stale data after a successful insert/collapse range operation.\n\nFor example, with 4K pages:\n\n page 0 page 1 page 2\n 0------4K 4K------8K 8K------12K\n ^ ^\n off=2K old_eof=10K\n\nPage 1 is removed from the page cache, while the boundary pages are\nonly partially zeroed. After COPYCHUNK moves the data on the server,\nthese cached pages may still return stale data.\n\nThis can be reproduced on a CIFS mount:\n\n bash -c '\n FILE=/mnt/scratch/repro\n\n # Use a 6 KiB file so EOF is not page-aligned.\n dd if=/dev/urandom of=/tmp/src bs=1K count=6 status=none\n\n # Expected: a 4 KiB hole followed by the original data.\n rm -f /tmp/expected\n truncate -s 4K /tmp/expected\n cat /tmp/src >> /tmp/expected\n\n cp /tmp/src \"$FILE\"\n\n # Prime the page cache before moving data on the server.\n cat \"$FILE\" > /dev/null\n\n fallocate --insert-range -o 0 -l 4K \"$FILE\"\n\n if cmp -s /tmp/expected \"$FILE\"; then\n echo \"readback: OK\"\n else\n echo \"readback: STALE DATA\"\n fi\n '\n\nFix this by writing back dirty data and discarding the page cache from\nthe start of the page containing off to EOF before moving data on the\nserver."
}
],
"lastModified": "2026-09-30T14:10:59.253",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}