CVE-2026-98124

A flaw was found in the Linux kernel's SMB (Server Message Block) client subsystem. When file modification operations such as fallocate range requests are performed on a mounted network share, the system fails to invalidate the local file system cache (FS-Cache). This flaw allows a local user to read stale or outdated cached data instead of the updated server contents, resulting in data inconsistency.

A low impact flaw was found in the Linux kernel SMB client as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the Red Hat Enterprise Linux CoreOS kernels used by OpenShift Container Platform 4 and 5. When SMB3 server-side range operations (fallocate zero-range, punch hole, insert range, or collapse range) modify file contents on the server, the client discards the affected page cache but leaves the FS-Cache cookie valid. As a result, a local user on a system with a CIFS mount created with the fsc option and an active CacheFiles backend may read stale data that was cached before the range operation instead of the updated server contents. The consequence is limited to this data inconsistency: the flaw does not allow privilege escalation, memory corruption, or denial of service. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those versions. Although the Red Hat CVSS 3.1 base score for this flaw is 5.5 (moderate), Red Hat assesses the overall impact as low because exploitation requires an uncommon configuration and only stale cached data can be exposed. Given this low impact rating, the fix for the affected streams is currently deferred rather than scheduled for an immediate update; the residual risk is that local users on FS-Cache-enabled CIFS mounts may continue to observe stale cached contents after server-side range operations until a fix is delivered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable FS-Cache on SMB mounts: unmount and remount the affected CIFS share without the fsc mount option (and remove fsc from the corresponding /etc/fstab or autofs entry so the change persists), or stop the CacheFiles backend serving the mount. Without fsc enabled, reads are served from the page cache or directly from the server and cannot return stale FS-Cache data after server-side range operations, at the cost of losing the local caching performance benefit for those mounts.