CVE-2026-98124 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb/client: invalidate fscache for fallocate range operations
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() modify file contents through server-side range operations. These operations discard the affected page cache, but leave the FS-Cache cookie valid, so a later read may return data cached before the range operation.
Fix this by invalidating FS-Cache after outstanding I/O has completed and before modifying the file on the server.
Run the following as root on a CIFS mount with fsc enabled and an active CacheFiles backend:
bash -c ' MNT=/mnt/cifs FILE="$MNT/repro"
# Generate four 1 MiB random blocks: [A][B][C][D].
dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none
# Expected contents after zeroing B: [A][zero][C][D].
cp /tmp/src /tmp/expected dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \ conv=notrunc status=none cp /tmp/src "$FILE"
# Populate FS-Cache, then discard the page cache. sync echo 1 > /proc/sys/vm/drop_caches cat "$FILE" > /dev/null sync echo 1 > /proc/sys/vm/drop_caches
fallocate --zero-range -o 1M -l 1M "$FILE"
if cmp -s /tmp/expected "$FILE"; then echo "readback: OK" else echo "readback: STALE DATA" fi '
Before this change, the readback differs from /tmp/expected:
readback: STALE DATA
After this change, it matches:
readback: OK
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel SMB client implementation contained a critical data consistency flaw related to file system caching mechanisms when handling server-side range operations. Specifically, functions such as smb3_zero_range, smb3_punch_hole, smb3_insert_range, and smb3_collapse_range are designed to modify file contents by instructing the remote server to adjust specific byte ranges within a file. While these operations correctly discard the local page cache entries associated with the affected blocks to prevent immediate stale reads from memory, they failed to invalidate the corresponding FS-Cache cookies. FS-Cache is an abstraction layer in Linux that allows clients to cache data locally for performance optimization, often backed by persistent storage systems like CacheFiles. When a range operation modifies or deletes data on the server side, any subsequent read request might retrieve outdated information from this local cache rather than fetching fresh data from the remote share, leading to significant data integrity issues where applications perceive stale content that no longer exists in its expected state on the file system.
This vulnerability represents a classic case of inconsistent caching behavior where metadata updates are not synchronized with cached data invalidation protocols. The technical flaw stems from the fact that while the kernel correctly handles the volatile page cache, it neglected to update the non-volatile FS-Cache state during these specific write operations. This discrepancy means that if an application performs a range modification followed by a read operation after the local memory caches have been dropped or evicted, the system will serve data from the persistent FS-Cache layer which still reflects the pre-modification state of the file. This behavior violates fundamental expectations of POSIX compliance and general file system semantics regarding data visibility and consistency across modifications. The issue is particularly insidious because it does not cause a crash or denial of service but rather results in silent data corruption, where applications operate on incorrect information without any error indication from the kernel layer.
From an industry standards perspective, this vulnerability aligns with CWE-362, which describes concurrent execution race conditions leading to state inconsistencies, although more accurately it falls under CWE-829 regarding inclusion of functionality from untrusted control sources if viewed through a data integrity lens, or more precisely CWE-175 regarding improper handling of inconsistent states. In the context of the MITRE ATT&CK framework, this behavior could be leveraged in techniques related to Data Manipulation or Defense Evasion, where an attacker might exploit stale cache reads to hide modifications or cause applications to behave unpredictably based on outdated data. The operational impact is severe for any workload relying on accurate file state after range-based operations, including database systems, document editors, and backup utilities that depend on precise byte-level consistency between local caches and remote storage states.
To mitigate this vulnerability, the kernel developers implemented a fix that ensures FS-Cache invalidation occurs at the correct point in the operation lifecycle. Specifically, the patch modifies the code to invalidate the FS-Cache entries for the affected ranges only after all outstanding I/O operations have completed but before the actual modification is committed on the server side. This sequencing guarantees that no stale data remains accessible through the cache layer once a write operation has been initiated. Administrators and users must ensure they are running an updated version of the Linux kernel where this patch is included. Additionally, verifying the integrity of critical files after performing range operations such as zeroing or punching holes can serve as a manual verification step in environments that cannot immediately update their kernels. Regular monitoring for unexpected data discrepancies in CIFS mounts with FS-Cache enabled is recommended to detect any residual instances of this behavior before full patch deployment.