In the Linux kernel’s SMB (CIFS) client, the pagecache for pages that extend beyond the original end‑of‑file was not correctly cleared when a clone‑range operation extended a file. The fault allowed stale data that had been written past the old EOF to remain in the kernel’s pagecache and become visible as file content after the file was extended. The result is an unintended disclosure of data that the user or process may not have permission to access, representing an information‑disclosure flaw.

This vulnerability affects the Linux kernel’s SMB client (CIFS) implementation on all versions that have not incorporated the fix. The committed patches identified by the Git references 15bb9f1d3e967e328649e92a1451e60a0dc66118 and 4721587f96cb8de8164f3fd203093a0875560999 provide the remediation, so kernels lacking those commits are potentially exposed.

No CVSS or EPSS score is available and the flaw is not listed in CISA’s KEV catalog, so the precise risk level is uncertain. The vulnerability requires a caller to invoke a clone‑range operation on an SMB‑exported file. The likely attack vector is a local user or process with sufficient privilege to perform that operation; a remote attacker would need to manipulate the SMB client to execute the clone‑range, which is not a feature controlled by the server. Exploitation would involve triggering a clone‑range to extend a file and then reading the newly exposed data, resulting in the leakage of previously private information.