Homepage

Information Exposure Through Caching Affecting kernel package, versions *

Severity

 Recommended
low

Based on CentOS security rating.

Threat Intelligence

EPSS
0.16% (5th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-KERNEL-20208833
  • published29 Sept 2026
  • disclosed25 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 25 Sep 2026

NewCVE-2026-98124  (opens in a new tab)
CWE-524  (opens in a new tab)

How to fix?

There is no fixed version for Centos:10 kernel.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel package and not the kernel package as distributed by Centos. See How to fix? for Centos:10 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

smb/client: invalidate fscache for fallocate range operations

smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() modify file contents through server-side range operations. These operations discard the affected page cache, but leave the FS-Cache cookie valid, so a later read may return data cached before the range operation.

Fix this by invalidating FS-Cache after outstanding I/O has completed and before modifying the file on the server.

Run the following as root on a CIFS mount with fsc enabled and an active CacheFiles backend:

    bash -c '
            MNT=/mnt/cifs
            FILE="$MNT/repro"


        # Generate four 1 MiB random blocks: [A][B][C][D].
        dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none

        # Expected contents after zeroing B: [A][zero][C][D].
        cp /tmp/src /tmp/expected
        dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \
                conv=notrunc status=none
        cp /tmp/src "$FILE"

        # Populate FS-Cache, then discard the page cache.
        sync
        echo 1 > /proc/sys/vm/drop_caches
        cat "$FILE" > /dev/null
        sync
        echo 1 > /proc/sys/vm/drop_caches

        fallocate --zero-range -o 1M -l 1M "$FILE"

        if cmp -s /tmp/expected "$FILE"; then
                echo "readback: OK"
        else
                echo "readback: STALE DATA"
        fi
'

Before this change, the readback differs from /tmp/expected:

    readback: STALE DATA

After this change, it matches:

    readback: OK

CVSS Base Scores

version 3.1