CVE-2026-89640
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep().
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 04b38d601239b4d9be641b412cf4b7456a041c67 | affected | git | f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4 | Unavailable | None listed |
| 04b38d601239b4d9be641b412cf4b7456a041c67 | affected | git | 7f62817fe049b0f3652518c1ba72631ec1e0a322 | Unavailable | None listed |
| 04b38d601239b4d9be641b412cf4b7456a041c67 | affected | git | b098f5e5858797827666e6cd73033f52fc39b5f6 | Unavailable | None listed |
| 04b38d601239b4d9be641b412cf4b7456a041c67 | affected | git | c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028 | Unavailable | None listed |
| 04b38d601239b4d9be641b412cf4b7456a041c67 | affected | git | b057ca17b656345d04669cb87f2aff9b31d873db | Unavailable | None listed |
| 04b38d601239b4d9be641b412cf4b7456a041c67 | affected | git | 6c322f5cf7476ded7a9a20f7be72462065a03c68 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 4.5 | Unavailable | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.157 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.109 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.50 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.4 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |