When a file is truncated to zero length via a CIFS/SMB share, the kernel’s truncate routine fails to invalidate the stale cache data on the client side. The missing invalidation allows the file system cache to continue serving old contents that were logically removed, exposing information that should no longer be accessible. This flaw is a misuse of the fscache subsystem and manifests as a confidentiality breach rather than code execution or privilege escalation (CWE-524).

All Linux kernel versions that ship a CIFS client prior to the commit that adds cifs_invalidate_cache() into cifs_do_truncate() are affected. The issue surfaces when a CIFS/SMB share is mounted with caching enabled, such as when using the fscache shares that use the fscache module on these kernels are at risk if the share contains sensitive data that might be truncated by an attacker or by legitimate operations.

The CVSS base score of 3.3 indicates low severity. The EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires write access to a CIFS/SMB share and the ability to truncate a file; an attacker with such access can trigger the bug and cause stale cached data to be served. No elevated privileges or privilege escalation are required, and no code execution is possible.