The Linux kernel’s SMB client contained a flaw where dirty page cache data was only flushed when a zeroed range touched the end-of-file. When a purely interior range was zeroed, the page cache was invalidated and the server was instructed to zero the range via FSCTL_SET_ZERO_DATA, but the dirty data remained unsafely cached. Consequently, a stale copy of that data could be written back to the server and later read, exposing information that should have been purged. The attack results in unintended disclosure of file contents that had previously been considered erased.

All Linux kernel releases that have not been updated with the commit fixing this issue are affected. The specific version range is not listed, so any system running an unpatched kernel may be vulnerable. The vulnerability applies to all Linux distributions that use the default kernel.

The CVSS score is not provided, and the EPSS score is unavailable; the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit code. Nonetheless, the flaw permits data leakage when SMB clients perform zeroing operations on interior ranges, which could be leveraged by an attacker with access to the SMB connection or by local users manipulating the kernel’s behavior. The risk is considered moderate to high if sensitive data is stored on SMB shares, but the likelihood of exploitation remains low until an attacker actively uses zero_range operations in a context that triggers the stale data path.