GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89640 (GCVE-0-2026-89640)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
Summary
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep().
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 04b38d601239b4d9be641b412cf4b7456a041c67 , < f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4 (git)
Affected: 04b38d601239b4d9be641b412cf4b7456a041c67 , < 7f62817fe049b0f3652518c1ba72631ec1e0a322 (git)
Affected: 04b38d601239b4d9be641b412cf4b7456a041c67 , < b098f5e5858797827666e6cd73033f52fc39b5f6 (git)
Affected: 04b38d601239b4d9be641b412cf4b7456a041c67 , < c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028 (git)
Affected: 04b38d601239b4d9be641b412cf4b7456a041c67 , < b057ca17b656345d04669cb87f2aff9b31d873db (git)
Affected: 04b38d601239b4d9be641b412cf4b7456a041c67 , < 6c322f5cf7476ded7a9a20f7be72462065a03c68 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.5
Unaffected: 0 , < 4.5 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4",
              "status": "affected",
              "version": "04b38d601239b4d9be641b412cf4b7456a041c67",
              "versionType": "git"
            },
            {
              "lessThan": "7f62817fe049b0f3652518c1ba72631ec1e0a322",
              "status": "affected",
              "version": "04b38d601239b4d9be641b412cf4b7456a041c67",
              "versionType": "git"
            },
            {
              "lessThan": "b098f5e5858797827666e6cd73033f52fc39b5f6",
              "status": "affected",
              "version": "04b38d601239b4d9be641b412cf4b7456a041c67",
              "versionType": "git"
            },
            {
              "lessThan": "c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028",
              "status": "affected",
              "version": "04b38d601239b4d9be641b412cf4b7456a041c67",
              "versionType": "git"
            },
            {
              "lessThan": "b057ca17b656345d04669cb87f2aff9b31d873db",
              "status": "affected",
              "version": "04b38d601239b4d9be641b412cf4b7456a041c67",
              "versionType": "git"
            },
            {
              "lessThan": "6c322f5cf7476ded7a9a20f7be72462065a03c68",
              "status": "affected",
              "version": "04b38d601239b4d9be641b412cf4b7456a041c67",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix loff_t underflow in cifs_remap_file_range() when len == 0\n\nWith len == 0 (clone to EOF), the effective length is computed as:\n\n    len = src_inode-\u003ei_size - off;\n\nIf off \u003e i_size, this is a negative loff_t, corrupting the ByteCount\nin the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range\nin filemap_write_and_wait_range().  The existing off \u003e= i_size check\nfires only after the ioctl has already been sent.\n\nSnapshot i_size_read() once for both the bounds check and the length\ncalculation, eliminating the TOCTOU and 32-bit torn-read risk.  Reject\noff \u003e src_size with -EINVAL.  Treat off == src_size as a no-op,\nconsistent with __generic_remap_file_range_prep()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the CIFS client remap method, reached from the local FICLONERANGE/FICLONE ioctls through vfs_clone_file_range() on an already-mounted CIFS share, not from SMB packet parsing in ksmbd or the TCP stack.\nAC:L - An attacker fully controls src_offset and src_length and can set length to 0 with offset past i_size, so the loff_t underflow is deterministic and does not depend on a race or memory layout they cannot influence.\nPR:L - vfs_clone_file_range() only requires a regular source opened for read and a regular destination opened for write; any unprivileged user with those fds on a CIFS mount can issue FICLONERANGE without capabilities or init-namespace root.\nUI:N - The attacker opens their own CIFS files and issues the ioctl; no separate victim action such as mounting a share or opening a file is required once a typical enterprise/autofs CIFS mount exists.\nS:U - Impact stays inside the host kernel and the CIFS inode/page cache of the same OS security authority; this is not a VM, IOMMU, or sandbox boundary crossing.\nC:N - The underflow does not read attacker-inaccessible kernel or file data; it miscomputes a clone length and then truncates destination page cache and sends a bad FSCTL, with no out-of-bounds or UAF read primitive.\nI:H - Negative len wraps destend to a huge uoff_t so truncate_inode_pages_range() discards the destination file\u0027s page cache, including dirty folios not flushed in the inverted range, silently destroying buffered data, and the same value corrupts ByteCount in FSCTL_DUPLICATE_EXTENTS_TO_FILE.\nA:H - The same wrapped range and signed-to-u64 conversion can set a huge/negative EOF via smb2_set_file_size()/cifs_resize_file_locked() on duplicate-extents servers and leave netfs/pagecache state inconsistent, which can oops, hang, or deny access to the affected file and kernel paths."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:42.820Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f62817fe049b0f3652518c1ba72631ec1e0a322"
        },
        {
          "url": "https://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028"
        },
        {
          "url": "https://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68"
        }
      ],
      "title": "cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89640",
    "datePublished": "2026-09-11T19:45:33.289Z",
    "dateReserved": "2026-09-11T19:38:34.740Z",
    "dateUpdated": "2026-09-14T12:01:42.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89640",
      "date": "2026-09-16",
      "epss": "0.00126",
      "percentile": "0.02625"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89640\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:49.733\",\"lastModified\":\"2026-09-14T13:19:16.940\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: fix loff_t underflow in cifs_remap_file_range() when len == 0\\n\\nWith len == 0 (clone to EOF), the effective length is computed as:\\n\\n    len = src_inode-\u003ei_size - off;\\n\\nIf off \u003e i_size, this is a negative loff_t, corrupting the ByteCount\\nin the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range\\nin filemap_write_and_wait_range().  The existing off \u003e= i_size check\\nfires only after the ioctl has already been sent.\\n\\nSnapshot i_size_read() once for both the bounds check and the length\\ncalculation, eliminating the TOCTOU and 32-bit torn-read risk.  Reject\\noff \u003e src_size with -EINVAL.  Treat off == src_size as a no-op,\\nconsistent with __generic_remap_file_range_prep().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/cifsfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"04b38d601239b4d9be641b412cf4b7456a041c67\",\"lessThan\":\"f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04b38d601239b4d9be641b412cf4b7456a041c67\",\"lessThan\":\"7f62817fe049b0f3652518c1ba72631ec1e0a322\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04b38d601239b4d9be641b412cf4b7456a041c67\",\"lessThan\":\"b098f5e5858797827666e6cd73033f52fc39b5f6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04b38d601239b4d9be641b412cf4b7456a041c67\",\"lessThan\":\"c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04b38d601239b4d9be641b412cf4b7456a041c67\",\"lessThan\":\"b057ca17b656345d04669cb87f2aff9b31d873db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04b38d601239b4d9be641b412cf4b7456a041c67\",\"lessThan\":\"6c322f5cf7476ded7a9a20f7be72462065a03c68\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/cifsfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7f62817fe049b0f3652518c1ba72631ec1e0a322\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-15T08:13:26+00:00",
      "cve": "CVE-2026-89640",
      "id": "CVE-2026-89640",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89640.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:57:41Z",
      "cve": "CVE-2026-89640",
      "id": "CVE-2026-89640",
      "initial_release_date": "2026-09-12T16:24:29Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89640",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89640.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.