The Linux kernel omits a required call to pagecache_isize_extended() when extending a file, causing the tail page that crosses the previous end‑of‑file to remain uncleared. This flaw is an instance of CWE‑201: Improper Restriction of Operations within the Bounds of a Resource, as the kernel permits dirty data beyond the logical file size to be written back to the server. Consequently, stale bytes that were previously written can be flushed to the CIFS share, allowing an attacker who can read the file on the server to recover sensitive information that is no longer part of the logical file contents.

The vulnerability affects any Linux system running a kernel version prior to the patch that adds the missing pagecache_isize_extended() call when CIFS is enabled. Systems that use CIFS mounts for shared storage and do not provide that code path are at riskSS score of 6.5 indicates moderate severity, and the EPSS score is < 1%, indicating a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack to a CIFS share that causes a file size extension, after which the stale data may be flushed to the server. Exploitation requires that the attacker can write to the share and that dirty pages containing relevant data are present. No publicly known exploits or active exploitation data exist, so the probability of immediate exploitation is low, but the potential for information leakage warrants preemptive action.

The CVSS base score of 6.5 indicates a medium severity flaw. The EPSS value of less than 1% signals a very low probability of exploitation in the wild, and there are no publicly known exploit references or active attacks reported in the CVE references. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not become a prioritized target. An attacker with the ability to write to a CIFS‑mounted file can deliberately increase the file size; during this operation the kernel may flush pages that contain stale data beyond the logical file end to the server if the protective call to pagecache_isize_extended() is omitted. If the attacker also has a mechanism to read those stale bytes from the server side (for example, by accessing the file directly on the server), they could recover sensitive information that should no longer be present. However, this requires both write privileges on the share and the existence of dirty pages holding the stale data, making the threat moderate but not trivial. Consequently, systems that rely on CIFS mounts and run kernels prior to the patch should consider promptly applying the kernel update or otherwise restricting write access to mitigate the risk.