CVE-2026-89640cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep().
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 04b38d601239b4d9be641b412cf4b7456a041c67 before f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4; from 04b38d601239b4d9be641b412cf4b7456a041c67 before 7f62817fe049b0f3652518c1ba72631ec1e0a322; from 04b38d601239b4d9be641b412cf4b7456a041c67 before b098f5e5858797827666e6cd73033f52fc39b5f6; from 04b38d601239b4d9be641b412cf4b7456a041c67 before c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028; from 04b38d601239b4d9be641b412cf4b7456a041c67 before b057ca17b656345d04669cb87f2aff9b31d873db; from 04b38d601239b4d9be641b412cf4b7456a041c67 before 6c322f5cf7476ded7a9a20f7be72462065a03c68 | CNA record |
References
- https://git.kernel.org/stable/c/f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4
- https://git.kernel.org/stable/c/7f62817fe049b0f3652518c1ba72631ec1e0a322
- https://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6
- https://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028
- https://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db
- https://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.