A bug in the Linux kernel’s SMB client causes the page cache to be partially zeroed during insert and collapse operations on a CIFS mount. When the range boundaries are not page aligned, the boundaries remain marked up‑to‑date and can still return stale data to the user after the operation has completed. This results in the client reading outdated data from the cache even though the underlying file on the server has changed. The vulnerability aligns with a cache consistency flaw, identified as CWE‑457, and does not provide arbitrary code execution or privilege escalation; it primarily undermines data integrity by exposing stale content.

The flaw affects all Linux kernels that implement the SMB3 client module used for CIFS mounts. No specific kernel releases are listed in the advisory, so all supported kernel versions prior to the applied fix are potentially vulnerable. The issue is tied to the smb3_insert_range() and smb3_collapse_range() functions and manifests when the insert‑range or collapse‑range system calls are invoked by an SMB server that moves data.

The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting an adversary would need to trigger routine file range updates to exploit the defect. Because the bug only affects cache consistency, the likelihood of widespread exploitation is low to moderate, but systems relying on precise file state after SMB range operations should monitor for anomalous stale reads. The impact is limited to data integrity and does not allow code execution, privilege escalation, or remote access.