HIGH Introduced in 4.5
cifs RemapRange Underflow
CVE-2026-89640
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
KernelScan AI5.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep().
02KernelScan AI Analysis
Risk summary
A local user with access to a file on a mounted CIFS share can trigger an integer underflow in the file clone path by requesting a clone-to-EOF with an offset beyond the source file size. The resulting corrupted length is used in kernel range operations and in the SMB request, potentially causing a kernel panic or hang. No special privileges are required beyond having the source file open.
Vulnerability analysis
When a user requests cloning to end-of-file with an offset that exceeds the source file's size, the CIFS client underflows the length calculation, producing a negative signed value. This corrupted length is then passed into kernel range-flushing operations, inverting the range, and is embedded in the SMB duplicate-extents request sent to the server, corrupting the request's ByteCount. The original code performed its bounds check only after the request had already been sent, and read the file size directly without an atomic accessor, creating a race window and a torn-read risk on 32-bit systems. The fix snapshots the source file size once atomically, rejects offsets beyond the file size before any operation begins, and treats the offset-equals-size case as a no-op. Any local process with a file open on a mounted CIFS share can trigger this via the copy-file-range syscall or the FICLONE ioctl; no elevated privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.5 | 6.12.109 | b098f5e58587 |
| 7.2 | 4.5 | 7.2.4 | b057ca17b656 |
| mainline | 4.5 | 7.3-rc1 | 6c322f5cf747 |
| 6.6 | 4.5 | 6.6.157 | 7f62817fe049 |
| 6.18 | 4.5 | 6.18.50 | c2a0dcb5a7a1 |
| 6.1 | 4.5 | 6.1.188 | f3d1ae1e6bc4 |
| cip/6.12 | 4.5 | 6.12.111-cip32 | b098f5e58587 |