{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89640", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.740Z", "datePublished": "2026-09-11T19:45:33.289Z", "dateUpdated": "2026-09-13T06:32:20.397Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-13T06:32:20.397Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix loff_t underflow in cifs_remap_file_range() when len == 0\n\nWith len == 0 (clone to EOF), the effective length is computed as:\n\n len = src_inode->i_size - off;\n\nIf off > i_size, this is a negative loff_t, corrupting the ByteCount\nin the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range\nin filemap_write_and_wait_range(). The existing off >= i_size check\nfires only after the ioctl has already been sent.\n\nSnapshot i_size_read() once for both the bounds check and the length\ncalculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject\noff > src_size with -EINVAL. Treat off == src_size as a no-op,\nconsistent with __generic_remap_file_range_prep()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the CIFS client remap method, reached from the local FICLONERANGE/FICLONE ioctls through vfs_clone_file_range() on an already-mounted CIFS share, not from SMB packet parsing in ksmbd or the TCP stack.\nAC:L - An attacker fully controls src_offset and src_length and can set length to 0 with offset past i_size, so the loff_t underflow is deterministic and does not depend on a race or memory layout they cannot influence.\nPR:L - vfs_clone_file_range() only requires a regular source opened for read and a regular destination opened for write; any unprivileged user with those fds on a CIFS mount can issue FICLONERANGE without capabilities or init-namespace root.\nUI:N - The attacker opens their own CIFS files and issues the ioctl; no separate victim action such as mounting a share or opening a file is required once a typical enterprise/autofs CIFS mount exists.\nS:U - Impact stays inside the host kernel and the CIFS inode/page cache of the same OS security authority; this is not a VM, IOMMU, or sandbox boundary crossing.\nC:N - The underflow does not read attacker-inaccessible kernel or file data; it miscomputes a clone length and then truncates destination page cache and sends a bad FSCTL, with no out-of-bounds or UAF read primitive.\nI:H - Negative len wraps destend to a huge uoff_t so truncate_inode_pages_range() discards the destination file's page cache, including dirty folios not flushed in the inverted range, silently destroying buffered data, and the same value corrupts ByteCount in FSCTL_DUPLICATE_EXTENTS_TO_FILE.\nA:H - The same wrapped range and signed-to-u64 conversion can set a huge/negative EOF via smb2_set_file_size()/cifs_resize_file_locked() on duplicate-extents servers and leave netfs/pagecache state inconsistent, which can oops, hang, or deny access to the affected file and kernel paths."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsfs.c"], "versions": [{"version": "04b38d601239b4d9be641b412cf4b7456a041c67", "lessThan": "b098f5e5858797827666e6cd73033f52fc39b5f6", "status": "affected", "versionType": "git"}, {"version": "04b38d601239b4d9be641b412cf4b7456a041c67", "lessThan": "c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028", "status": "affected", "versionType": "git"}, {"version": "04b38d601239b4d9be641b412cf4b7456a041c67", "lessThan": "b057ca17b656345d04669cb87f2aff9b31d873db", "status": "affected", "versionType": "git"}, {"version": "04b38d601239b4d9be641b412cf4b7456a041c67", "lessThan": "6c322f5cf7476ded7a9a20f7be72462065a03c68", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsfs.c"], "versions": [{"version": "4.5", "status": "affected"}, {"version": "0", "lessThan": "4.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6"}, {"url": "https://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028"}, {"url": "https://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db"}, {"url": "https://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68"}], "title": "cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/cifsfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b098f5e5858797827666e6cd73033f52fc39b5f6", "status": "affected", "version": "04b38d601239b4d9be641b412cf4b7456a041c67", "versionType": "git"}, {"lessThan": "c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028", "status": "affected", "version": "04b38d601239b4d9be641b412cf4b7456a041c67", "versionType": "git"}, {"lessThan": "b057ca17b656345d04669cb87f2aff9b31d873db", "status": "affected", "version": "04b38d601239b4d9be641b412cf4b7456a041c67", "versionType": "git"}, {"lessThan": "6c322f5cf7476ded7a9a20f7be72462065a03c68", "status": "affected", "version": "04b38d601239b4d9be641b412cf4b7456a041c67", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/cifsfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"lessThan": "4.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix loff_t underflow in cifs_remap_file_range() when len == 0\n\nWith len == 0 (clone to EOF), the effective length is computed as:\n\n len = src_inode->i_size - off;\n\nIf off > i_size, this is a negative loff_t, corrupting the ByteCount\nin the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range\nin filemap_write_and_wait_range(). The existing off >= i_size check\nfires only after the ioctl has already been sent.\n\nSnapshot i_size_read() once for both the bounds check and the length\ncalculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject\noff > src_size with -EINVAL. Treat off == src_size as a no-op,\nconsistent with __generic_remap_file_range_prep()."}], "id": "CVE-2026-89640", "lastModified": "2026-09-13T07:17:29.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:49.733", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: CIFS `remap_file_range` vulnerability due to `loff_t` underflow", "id": "2532516", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532516"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When performing a file range remapping operation with a zero length, an integer underflow can occur if the offset exceeds the file size. This can lead to corruption of the byte count in file system control requests, potentially causing unexpected behavior or data integrity issues. The vulnerability is resolved by correctly validating the offset against the file size before calculating the length, preventing the underflow."], "name": "CVE-2026-89640", "public_date": "2026-09-11T19:45:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89640\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89640\nhttps://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68\nhttps://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db\nhttps://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6\nhttps://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04b38d601239b4d9be641b412cf4b7456a041c67,b098f5e5858797827666e6cd73033f52fc39b5f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04b38d601239b4d9be641b412cf4b7456a041c67,c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04b38d601239b4d9be641b412cf4b7456a041c67,b057ca17b656345d04669cb87f2aff9b31d873db)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04b38d601239b4d9be641b412cf4b7456a041c67,6c322f5cf7476ded7a9a20f7be72462065a03c68)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T09:15:12.757075+00:00", "updated": "2026-09-13T14:45:10.267722+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}