cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep().
CVE-2026-89640
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89640
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "04b38d601239b4d9be641b412cf4b7456a041c67",
"lessThan": "f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4",
"versionType": "git"
},
{
"status": "affected",
"version": "04b38d601239b4d9be641b412cf4b7456a041c67",
"lessThan": "7f62817fe049b0f3652518c1ba72631ec1e0a322",
"versionType": "git"
},
{
"status": "affected",
"version": "04b38d601239b4d9be641b412cf4b7456a041c67",
"lessThan": "b098f5e5858797827666e6cd73033f52fc39b5f6",
"versionType": "git"
},
{
"status": "affected",
"version": "04b38d601239b4d9be641b412cf4b7456a041c67",
"lessThan": "c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028",
"versionType": "git"
},
{
"status": "affected",
"version": "04b38d601239b4d9be641b412cf4b7456a041c67",
"lessThan": "b057ca17b656345d04669cb87f2aff9b31d873db",
"versionType": "git"
},
{
"status": "affected",
"version": "04b38d601239b4d9be641b412cf4b7456a041c67",
"lessThan": "6c322f5cf7476ded7a9a20f7be72462065a03c68",
"versionType": "git"
}
],
"programFiles": [
"fs/smb/client/cifsfs.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/client/cifsfs.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89640
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #35138 · Revision 1
- Added to Heist Feed
- Publisher date