A bug in the Linux kernel SMB client caused certain server‑side file range operations, such as zero‑range or punch‑hole, to leave the FS‑Cache cookie valid after the page cache was discarded. As a result, subsequent reads could return data that had been cached before the range operation was applied, allowing stale or incorrect data to be accessed. This weakness can lead to data integrity violations where a reader obtains outdated or erroneous file contents.

The issue affects all Linux kernel versions running CIFS mounts with FS‑Cache enabled until the patch that forces a cache invalidation after I/O completes is applied. The vulnerability is vendor‑agnostic within the Linux distribution, targeting the Linux kernel itself, and does not depend on specific kernel releases or patches beyond the current update that introduces the fix.

The CVSS score is not listed, but the EPSS is not available and the vulnerability is not currently in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker with access to a CIFS share performing a range operation that modifies a file and then reading the file afterward. While the vulnerability does not provide remote code execution or privilege escalation, the risk lies in the loss of data integrity and the potential for incorrect application behaviour or user confusion. The exploit would need to execute the specific sequence of a server‑side range operation followed by a read on the same file before the system flushes the FS‑Cache.