In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3_zero_range() emulates… (CVE-2026-98683)

The Linux kernel SMB client function smb3_zero_range() emulates the FALLOC_FL_ZERO_RANGE operation by invalidating the page cache over a target range and issuing FSCTL_SET_ZERO_DATA to the server. Previously, dirty data flushing was conditional and only occurred if the zero range reached or extended the end of the file (EOF). For zero ranges entirely within the file (interior ranges), no flush occurred, allowing dirty folios overlapping the range to be written back after zeroing, resulting in stale data overwriting the zeroed range. The fix enforces unconditional flushing and waiting for dirty data in the range before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA, consistent with the approach used in smb3_punch_hole(). This resolves the issue of stale data being read where zeroed data is expected, as observed against Windows Server.

The vulnerability could cause clients to read stale data from SMB shares when zeroing file ranges that do not extend to EOF. This undermines data integrity by allowing previously cached dirty data to overwrite zeroed regions, potentially leading to incorrect application behavior or data corruption when zeroed data is expected. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to unconditionally flush dirty data before zeroing a range in the SMB client code. Users should apply the official kernel update containing this fix once available. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended remediation. No alternative mitigations are indicated.