CVE-2026-98125
UnknownSummary
In the Linux kernel SMB client, smb3_insert_range() and smb3_collapse_range() failed to properly invalidate the page cache when the offset or old EOF was not page-aligned. Boundary pages were only partially zeroed and remained uptodate, so the client could return stale data after a successful insert/collapse range operation.
Risk Assessment
After an insert or collapse range operation on a CIFS mount, applications may read stale file data, potentially leading to incorrect processing, data corruption, or wrong decisions based on file contents.
Recommendation
Update the Linux kernel to a version containing the fix that writes back dirty data and discards the page cache from the start of the page containing off to EOF before moving data on the server.
Other vulnerabilities in Linux kernel SMB client
See all- CVE-2026-89637Critical
In the Linux kernel SMB client, cifs_check_trans2() returning false for a malformed secondary T2 response (invalid SMB header or PDU rejected by check2ndT2()) causes handle_mid() to overwrite mid->resp_buf with the new buffer, leaking the primary buffer and leaving server->smallbuf/bigbuf dangling. This results in a use-after-free when the demux thread reuses the freed buffer.
- CVE-2026-89636Critical
In the Linux kernel SMB client, free_tgts() frees all structures in ce->tlist but leaves ce->tgthint pointing to one of the freed cache_dfs_tgt structures. If the pointer is not reset before later use, a use-after-free occurs.
- CVE-2026-89634Critical
In the Linux kernel SMB client, the ALIGN() macro in symlink_data() can overflow for ErrorDataLength values near UINT32_MAX (e.g. 0xFFFFFFF9), wrapping to 0. This causes the bounds check to pass and the loop to advance by zero bytes, leaving pointer 'p' pointing into stale data.
- CVE-2026-89633Critical
In the Linux kernel SMB client, coalesce_t2() computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area and overwrite header fields, while a large one can push it past the buffer end, causing out-of-bounds heap reads or writes.
- CVE-2026-89631Critical
In the Linux kernel SMB client, CIFSTCon() bounds its strnlen() by the server's ByteCount minus two, which for ByteCount 0 or 1 becomes negative as an int and converts to a huge size_t. The later subtraction wraps __u16 bytes_left, allowing cifs_strndup_from_utf16() to read up to 65535 bytes from a ~16 KB object, leaking data through /proc/fs/cifs/DebugData.
- CVE-2026-89632High
In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.
- CVE-2026-46139Medium
A vulnerability has been identified in the Linux kernel SMB client related to improper initialization of the security descriptor buffer. A change in the data structure caused the reserved field to remain uninitialized, leading to errors when attempting to use chmod.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3_insert_range() and smb3_collapse_range() use truncate_pagecache_range() to invalidate the affected page cache. However, if off or old_eof is not page-aligned, the boundary pages are only partially zeroed and remain uptodate. As a result, the client may return stale data after a successful insert/collapse range operation. For example, with 4K pages: page 0 page 1 page 2 0------4K 4K------8K 8K------12K ^ ^ off=2K old_eof=10K Page 1 is removed from the page cache, while the boundary pages are only partially zeroed. After COPYCHUNK moves the data on the server, these cached pages may still return stale data. This can be reproduced on a CIFS mount: bash -c ' FILE=/mnt/scratch/repro # Use a 6 KiB file so EOF is not page-aligned. dd if=/dev/urandom of=/tmp/src bs=1K count=6 status=none # Expected: a 4 KiB hole followed by the original data. rm -f /tmp/expected truncate -s 4K /tmp/expected cat /tmp/src >> /tmp/expected cp /tmp/src "$FILE" # Prime the page cache before moving data on the server. cat "$FILE" > /dev/null fallocate --insert-range -o 0 -l 4K "$FILE" if cmp -s /tmp/expected "$FILE"; then echo "readback: OK" else echo "readback: STALE DATA" fi ' Fix this by writing back dirty data and discarding the page cache from the start of the page containing off to EOF before moving data on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS