{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98124", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.318Z", "datePublished": "2026-09-25T10:36:06.581Z", "dateUpdated": "2026-10-21T12:54:35.267Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:54:35.267Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: invalidate fscache for fallocate range operations\n\nsmb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and\nsmb3_collapse_range() modify file contents through server-side range\noperations. These operations discard the affected page cache, but leave\nthe FS-Cache cookie valid, so a later read may return data cached before\nthe range operation.\n\nFix this by invalidating FS-Cache after outstanding I/O has completed\nand before modifying the file on the server.\n\nRun the following as root on a CIFS mount with fsc enabled and an active\nCacheFiles backend:\n\n bash -c '\n MNT=/mnt/cifs\n FILE=\"$MNT/repro\"\n\n # Generate four 1 MiB random blocks: [A][B][C][D].\n dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none\n\n # Expected contents after zeroing B: [A][zero][C][D].\n cp /tmp/src /tmp/expected\n dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \\\n conv=notrunc status=none\n cp /tmp/src \"$FILE\"\n\n # Populate FS-Cache, then discard the page cache.\n sync\n echo 1 > /proc/sys/vm/drop_caches\n cat \"$FILE\" > /dev/null\n sync\n echo 1 > /proc/sys/vm/drop_caches\n\n fallocate --zero-range -o 1M -l 1M \"$FILE\"\n\n if cmp -s /tmp/expected \"$FILE\"; then\n echo \"readback: OK\"\n else\n echo \"readback: STALE DATA\"\n fi\n '\n\nBefore this change, the readback differs from /tmp/expected:\n\n readback: STALE DATA\n\nAfter this change, it matches:\n\n readback: OK"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "cc7202a51b8777a757bda9dcfbf339f828c6a130", "status": "affected", "versionType": "git"}, {"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5", "status": "affected", "versionType": "git"}, {"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "93c6e5a8d7c5071d586c1411596d5db5faad22b2", "status": "affected", "versionType": "git"}, {"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "448ba0ae65ca61064183564d2983c9aa59bd6ba7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "3.17", "status": "affected"}, {"version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc7202a51b8777a757bda9dcfbf339f828c6a130"}, {"url": "https://git.kernel.org/stable/c/dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5"}, {"url": "https://git.kernel.org/stable/c/93c6e5a8d7c5071d586c1411596d5db5faad22b2"}, {"url": "https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"}], "title": "smb/client: invalidate fscache for fallocate range operations", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc7202a51b8777a757bda9dcfbf339f828c6a130", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}, {"lessThan": "dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}, {"lessThan": "93c6e5a8d7c5071d586c1411596d5db5faad22b2", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}, {"lessThan": "448ba0ae65ca61064183564d2983c9aa59bd6ba7", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"lessThan": "3.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "438C480C-978E-4F8C-A37D-7CB29AE32E61", "versionEndExcluding": "6.6.160", "versionStartIncluding": "3.17.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:-:*:*:*:*:*:*", "matchCriteriaId": "7DD957C0-0777-4304-9BCA-7E8429CBE3D3", "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BACEDE75-270F-419E-A22D-025914C6BA15", "versionEndExcluding": "7.2.7", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:-:*:*:*:*:*:*", "matchCriteriaId": "3A351B03-87A0-405B-8A9B-488E173E1E3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "434E8752-0D8B-42E1-8B8F-23C409AB442C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "D64AD3CD-8D3C-4749-9042-969F524DCB68", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "4B4E29E3-9F10-43B1-A349-1F7484F6015A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "4223286C-F679-4FEC-B144-1C3B942BD506", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc6:*:*:*:*:*:*", "matchCriteriaId": "C889AAA8-186E-433F-A31D-FF09221E1EBC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc7:*:*:*:*:*:*", "matchCriteriaId": "80BC78EE-50D8-4561-A6A6-A370E72F215B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*", "matchCriteriaId": "5A3F9505-6B98-4269-8B81-127E55A1BF00", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*", "matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: invalidate fscache for fallocate range operations\n\nsmb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and\nsmb3_collapse_range() modify file contents through server-side range\noperations. These operations discard the affected page cache, but leave\nthe FS-Cache cookie valid, so a later read may return data cached before\nthe range operation.\n\nFix this by invalidating FS-Cache after outstanding I/O has completed\nand before modifying the file on the server.\n\nRun the following as root on a CIFS mount with fsc enabled and an active\nCacheFiles backend:\n\n bash -c '\n MNT=/mnt/cifs\n FILE=\"$MNT/repro\"\n\n # Generate four 1 MiB random blocks: [A][B][C][D].\n dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none\n\n # Expected contents after zeroing B: [A][zero][C][D].\n cp /tmp/src /tmp/expected\n dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \\\n conv=notrunc status=none\n cp /tmp/src \"$FILE\"\n\n # Populate FS-Cache, then discard the page cache.\n sync\n echo 1 > /proc/sys/vm/drop_caches\n cat \"$FILE\" > /dev/null\n sync\n echo 1 > /proc/sys/vm/drop_caches\n\n fallocate --zero-range -o 1M -l 1M \"$FILE\"\n\n if cmp -s /tmp/expected \"$FILE\"; then\n echo \"readback: OK\"\n else\n echo \"readback: STALE DATA\"\n fi\n '\n\nBefore this change, the readback differs from /tmp/expected:\n\n readback: STALE DATA\n\nAfter this change, it matches:\n\n readback: OK"}], "id": "CVE-2026-98124", "lastModified": "2026-10-22T16:38:53.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-09-25T11:17:43.720", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/93c6e5a8d7c5071d586c1411596d5db5faad22b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc7202a51b8777a757bda9dcfbf339f828c6a130"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-672"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: smb/client: invalidate fscache for fallocate range operations", "id": "2541341", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541341"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-524", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb/client: invalidate fscache for fallocate range operations\nsmb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and\nsmb3_collapse_range() modify file contents through server-side range\noperations. These operations discard the affected page cache, but leave\nthe FS-Cache cookie valid, so a later read may return data cached before\nthe range operation.\nFix this by invalidating FS-Cache after outstanding I/O has completed\nand before modifying the file on the server.\nRun the following as root on a CIFS mount with fsc enabled and an active\nCacheFiles backend:\nbash -c '\nMNT=/mnt/cifs\nFILE=\"$MNT/repro\"\n# Generate four 1 MiB random blocks: [A][B][C][D].\ndd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none\n# Expected contents after zeroing B: [A][zero][C][D].\ncp /tmp/src /tmp/expected\ndd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \\\nconv=notrunc status=none\ncp /tmp/src \"$FILE\"\n# Populate FS-Cache, then discard the page cache.\nsync\necho 1 > /proc/sys/vm/drop_caches\ncat \"$FILE\" > /dev/null\nsync\necho 1 > /proc/sys/vm/drop_caches\nfallocate --zero-range -o 1M -l 1M \"$FILE\"\nif cmp -s /tmp/expected \"$FILE\"; then\necho \"readback: OK\"\nelse\necho \"readback: STALE DATA\"\nfi\n'\nBefore this change, the readback differs from /tmp/expected:\nreadback: STALE DATA\nAfter this change, it matches:\nreadback: OK", "A flaw was found in the Linux kernel's SMB (Server Message Block) client subsystem. When file modification operations such as fallocate range requests are performed on a mounted network share, the system fails to invalidate the local file system cache (FS-Cache). This flaw allows a local user to read stale or outdated cached data instead of the updated server contents, resulting in data inconsistency."], "name": "CVE-2026-98124", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98124\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98124\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98124.mbox"], "threat_severity": "Low"}