GHSA-WCF3-P4HX-GG65

Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

smb/client: invalidate fscache for fallocate range operations

smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() modify file contents through server-side range operations. These operations discard the affected page cache, but leave the FS-Cache cookie valid, so a later read may return data cached before the range operation.

Fix this by invalidating FS-Cache after outstanding I/O has completed and before modifying the file on the server.

Run the following as root on a CIFS mount with fsc enabled and an active CacheFiles backend:

    bash -c '
            MNT=/mnt/cifs
            FILE="$MNT/repro"

            # Generate four 1 MiB random blocks: [A][B][C][D].
            dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none

            # Expected contents after zeroing B: [A][zero][C][D].
            cp /tmp/src /tmp/expected
            dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \
                    conv=notrunc status=none
            cp /tmp/src "$FILE"

            # Populate FS-Cache, then discard the page cache.
            sync
            echo 1 > /proc/sys/vm/drop_caches
            cat "$FILE" > /dev/null
            sync
            echo 1 > /proc/sys/vm/drop_caches

            fallocate --zero-range -o 1M -l 1M "$FILE"

            if cmp -s /tmp/expected "$FILE"; then
                    echo "readback: OK"
            else
                    echo "readback: STALE DATA"
            fi
    '

Before this change, the readback differs from /tmp/expected:

    readback: STALE DATA

After this change, it matches:

    readback: OK
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-98124"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T11:17:43Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: invalidate fscache for fallocate range operations\n\nsmb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and\nsmb3_collapse_range() modify file contents through server-side range\noperations. These operations discard the affected page cache, but leave\nthe FS-Cache cookie valid, so a later read may return data cached before\nthe range operation.\n\nFix this by invalidating FS-Cache after outstanding I/O has completed\nand before modifying the file on the server.\n\nRun the following as root on a CIFS mount with fsc enabled and an active\nCacheFiles backend:\n\n        bash -c \u0027\n                MNT=/mnt/cifs\n                FILE=\"$MNT/repro\"\n\n                # Generate four 1 MiB random blocks: [A][B][C][D].\n                dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none\n\n                # Expected contents after zeroing B: [A][zero][C][D].\n                cp /tmp/src /tmp/expected\n                dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \\\n                        conv=notrunc status=none\n                cp /tmp/src \"$FILE\"\n\n                # Populate FS-Cache, then discard the page cache.\n                sync\n                echo 1 \u003e /proc/sys/vm/drop_caches\n                cat \"$FILE\" \u003e /dev/null\n                sync\n                echo 1 \u003e /proc/sys/vm/drop_caches\n\n                fallocate --zero-range -o 1M -l 1M \"$FILE\"\n\n                if cmp -s /tmp/expected \"$FILE\"; then\n                        echo \"readback: OK\"\n                else\n                        echo \"readback: STALE DATA\"\n                fi\n        \u0027\n\nBefore this change, the readback differs from /tmp/expected:\n\n        readback: STALE DATA\n\nAfter this change, it matches:\n\n        readback: OK",
  "id": "GHSA-wcf3-p4hx-gg65",
  "modified": "2026-09-25T12:31:37Z",
  "published": "2026-09-25T12:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98124"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/93c6e5a8d7c5071d586c1411596d5db5faad22b2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.