{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98682", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.364Z", "datePublished": "2026-10-18T15:45:47.375Z", "dateUpdated": "2026-10-19T09:23:52.548Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:52.548Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: drain and invalidate before server-side copy/clone\n\ncifs_file_copychunk_range() and the clone (FICLONE) path of\ncifs_remap_file_range() do not serialise the destination page cache\nagainst the server-side copy the way the other server-side range\noperations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()\nand smb3_insert_range()) do.\n\ncifs_file_copychunk_range() invalidates the destination range with\nfilemap_invalidate_inode(), which takes and drops the mapping's\ninvalidate_lock internally, so the lock is no longer held when the\ncopychunk ioctl is issued. It also never drains in-flight netfs I/O on\nthe target. The clone path never takes the invalidate_lock at all (only\ni_rwsem), uses a bare truncate_inode_pages_range() and likewise does not\ndrain outstanding I/O.\n\nAs a result an asynchronous destination writeback can complete after the\nserver-side copy/clone has run and reinstate stale data over the region\njust written by the server, corrupting the file. This is the same class\nof corruption as commit d7d2adcd022b (\"smb/client: flush dirty data\nbefore punching a hole\") and has been seen randomly in generic/363\nagainst Windows Server.\n\nFix both paths to follow the established ordering: hold the target\nmapping's invalidate_lock across the flush and invalidation of the\ndestination and the server ioctl, and call netfs_wait_for_outstanding_io()\non the target to drain in-flight writes before the ioctl is issued. Only\nthe target inode's invalidate_lock is required, as the source is merely\nflushed and not invalidated; i_rwsem (already held via\nlock_two_nondirectories()) is acquired before the invalidate_lock,\nmatching the VFS lock ordering. Since filemap_invalidate_inode() takes\nthat same lock internally, replace it with its own unmap/flush/invalidate\nsteps instead of calling it, and return early on a zero-length copy to\navoid a range underflow."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsfs.c"], "versions": [{"version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "lessThan": "dc71660f11ef2fecc0695a41e49cd496a9d255ab", "status": "affected", "versionType": "git"}, {"version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "lessThan": "c9b1194e8ec99d95db25db45edd2fbf690f043ab", "status": "affected", "versionType": "git"}, {"version": "358bd5f436d820bb758833050aae065b35d6986c", "status": "affected", "versionType": "git"}, {"version": "43801359c8971cc49b4a4db5015fba77fbd09c32", "status": "affected", "versionType": "git"}, {"version": "6.1.68", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.7", "lessThan": "6.7", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsfs.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.68"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dc71660f11ef2fecc0695a41e49cd496a9d255ab"}, {"url": "https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab"}], "title": "smb: client: drain and invalidate before server-side copy/clone", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/cifsfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dc71660f11ef2fecc0695a41e49cd496a9d255ab", "status": "affected", "version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "versionType": "git"}, {"lessThan": "c9b1194e8ec99d95db25db45edd2fbf690f043ab", "status": "affected", "version": "c54fc3a4f375663f2361a9cbb2955fb4ef912879", "versionType": "git"}, {"status": "affected", "version": "358bd5f436d820bb758833050aae065b35d6986c", "versionType": "git"}, {"status": "affected", "version": "43801359c8971cc49b4a4db5015fba77fbd09c32", "versionType": "git"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.68", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/cifsfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: drain and invalidate before server-side copy/clone\n\ncifs_file_copychunk_range() and the clone (FICLONE) path of\ncifs_remap_file_range() do not serialise the destination page cache\nagainst the server-side copy the way the other server-side range\noperations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()\nand smb3_insert_range()) do.\n\ncifs_file_copychunk_range() invalidates the destination range with\nfilemap_invalidate_inode(), which takes and drops the mapping's\ninvalidate_lock internally, so the lock is no longer held when the\ncopychunk ioctl is issued. It also never drains in-flight netfs I/O on\nthe target. The clone path never takes the invalidate_lock at all (only\ni_rwsem), uses a bare truncate_inode_pages_range() and likewise does not\ndrain outstanding I/O.\n\nAs a result an asynchronous destination writeback can complete after the\nserver-side copy/clone has run and reinstate stale data over the region\njust written by the server, corrupting the file. This is the same class\nof corruption as commit d7d2adcd022b (\"smb/client: flush dirty data\nbefore punching a hole\") and has been seen randomly in generic/363\nagainst Windows Server.\n\nFix both paths to follow the established ordering: hold the target\nmapping's invalidate_lock across the flush and invalidation of the\ndestination and the server ioctl, and call netfs_wait_for_outstanding_io()\non the target to drain in-flight writes before the ioctl is issued. Only\nthe target inode's invalidate_lock is required, as the source is merely\nflushed and not invalidated; i_rwsem (already held via\nlock_two_nondirectories()) is acquired before the invalidate_lock,\nmatching the VFS lock ordering. Since filemap_invalidate_inode() takes\nthat same lock internally, replace it with its own unmap/flush/invalidate\nsteps instead of calling it, and return early on a zero-length copy to\navoid a range underflow."}], "id": "CVE-2026-98682", "lastModified": "2026-10-19T10:19:32.627", "metrics": {}, "published": "2026-10-18T16:17:21.557", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc71660f11ef2fecc0695a41e49cd496a9d255ab"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: drain and invalidate before server-side copy/clone", "id": "2555092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555092"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-664", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: drain and invalidate before server-side copy/clone\ncifs_file_copychunk_range() and the clone (FICLONE) path of\ncifs_remap_file_range() do not serialise the destination page cache\nagainst the server-side copy the way the other server-side range\noperations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()\nand smb3_insert_range()) do.\ncifs_file_copychunk_range() invalidates the destination range with\nfilemap_invalidate_inode(), which takes and drops the mapping's\ninvalidate_lock internally, so the lock is no longer held when the\ncopychunk ioctl is issued. It also never drains in-flight netfs I/O on\nthe target. The clone path never takes the invalidate_lock at all (only\ni_rwsem), uses a bare truncate_inode_pages_range() and likewise does not\ndrain outstanding I/O.\nAs a result an asynchronous destination writeback can complete after the\nserver-side copy/clone has run and reinstate stale data over the region\njust written by the server, corrupting the file. This is the same class\nof corruption as commit d7d2adcd022b (\"smb/client: flush dirty data\nbefore punching a hole\") and has been seen randomly in generic/363\nagainst Windows Server.\nFix both paths to follow the established ordering: hold the target\nmapping's invalidate_lock across the flush and invalidation of the\ndestination and the server ioctl, and call netfs_wait_for_outstanding_io()\non the target to drain in-flight writes before the ioctl is issued. Only\nthe target inode's invalidate_lock is required, as the source is merely\nflushed and not invalidated; i_rwsem (already held via\nlock_two_nondirectories()) is acquired before the invalidate_lock,\nmatching the VFS lock ordering. Since filemap_invalidate_inode() takes\nthat same lock internally, replace it with its own unmap/flush/invalidate\nsteps instead of calling it, and return early on a zero-length copy to\navoid a range underflow.", "A flaw was found in the Linux kernel's Server Message Block (SMB) client subsystem. Due to improper synchronization during server-side file copy and clone operations, pending write operations are not drained before copying begins. A local user could exploit this timing issue during copy operations to overwrite newly copied data with stale data, resulting in file corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98682", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98682\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98682\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98682.mbox\nhttps://kernelcve.org/list/?q=CVE-2026-98682"], "statement": "The SMB client does not fully serialize server-side copy or clone operations against asynchronous writeback and cached pages for the destination file. An in-flight destination write can complete after the server has copied or cloned the requested range and can restore stale cached data over the new server-side contents. This produces persistent destination file corruption and was observed during generic/363 testing against Windows Server. For the CVSS the PR:L because a local user or process with access to the SMB mount and permission to copy or clone into the destination can reach the affected paths without administrative capabilities. AC:H applies because successful triggering depends on a timing window between asynchronous destination I/O and the server-side operation. The issue is not directly reachable through unsolicited network traffic because the vulnerable operation is initiated on the SMB client, although the affected file and copy operation involve a remote SMB server. The confirmed impact is integrity loss through file corruption. There is no supported kernel memory corruption or information disclosure primitive. The worst still defensible availability impact is loss of access to corrupted application data rather than a kernel crash or privilege escalation.", "threat_severity": "Low"}