CVE-2026-98125

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This flaw allows a local user to read stale or inconsistent file data from a mounted network share. When modifying file ranges using insert or collapse operations, offsets that are not aligned with memory page boundaries fail to completely clear the local cache. Consequently, subsequent read operations can return outdated data rather than the updated file contents from the server.

A flaw was found in the Linux kernel SMB client affecting Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.16 and later (via the RHEL 9 based CoreOS kernel). Red Hat rates the impact of this flaw as low. When an insert-range or collapse-range operation (for example via fallocate) is performed on a file on a mounted SMB/CIFS share using an offset or old end-of-file that is not page-aligned, the client only partially zeroes the boundary pages of its local page cache before the data is moved on the server via COPYCHUNK. Those boundary pages remain marked uptodate, so a local user with access to the file can subsequently read stale or inconsistent cached data instead of the updated contents stored on the server. The data on the server itself is not corrupted, and triggering the issue requires local access to a system with an SMB share mounted as well as permission to modify files on that share; no memory corruption, privilege escalation, or availability impact is involved. This is why the impact is rated low despite the moderate CVSS:3.1 base score of 5.5.

Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 Extended Update Support stream, and OpenShift Container Platform 4.15 and earlier are not affected because the vulnerable code is not present in those versions. For the affected streams the fix is currently deferred because of the low security impact of the issue. The residual risk is that applications that perform unaligned insert or collapse range operations on files on SMB-mounted shares may read outdated cached data until the page cache is refreshed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.