In the Linux kernel’s SMB (CIFS) client, the pagecache for pages that extend beyond the original end‑of‑file was not correctly cleared when a clone‑range operation extended a file. The fault allowed stale data that had been written past the old EOF to remain in the kernel’s pagecache and become visible as file content after the file was extended. This results in an unintended disclosure of data that could be exposed to a user reading the file after the operation, representing an information‑disclosure flaw.

This vulnerability affects the Linux kernel’s SMB client (CIFS) implementation on all versions that have not incorporated the fix. Kernels lacking the fix associated with commits 15bb9f1d3e967e328649e92a1451e60a0dc66118 and 4721587f96cb8de8164f3fd203093a0875560999 are potentially exposed.

The CVSS score is 3.3 and the EPSS score is less than 1%, indicating low severity and a very low likelihood of exploitation. It is not listed in CISA’s KEV catalog. The flaw requires a caller to invoke a clone‑range operation on an SMB‑exported file. The likely attack vector is a local user or process with adequate privileges to perform that operation; a remote attacker would need to manipulate the SMB client to invoke the clone‑range, a feature not controlled by the server. Successful exploitation would involve triggering a clone‑range to extend a file and then reading the newly exposed data, resulting in the leakage of previously private information.