smb: client: drain and invalidate before server-side copy/clone
Summary
| CVE | CVE-2026-98682 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-10-18 16:17:21 UTC |
|---|
| Updated | 2026-10-19 10:19:32 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
smb: client: drain and invalidate before server-side copy/clone
cifs_file_copychunk_range() and the clone (FICLONE) path of
cifs_remap_file_range() do not serialise the destination page cache
against the server-side copy the way the other server-side range
operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()
and smb3_insert_range()) do.
cifs_file_copychunk_range() invalidates the destination range with
filemap_invalidate_inode(), which takes and drops the mapping's
invalidate_lock internally, so the lock is no longer held when the
copychunk ioctl is issued. It also never drains in-flight netfs I/O on
the target. The clone path never takes the invalidate_lock at all (only
i_rwsem), uses a bare truncate_inode_pages_range() and likewise does not
drain outstanding I/O.
As a result an asynchronous destination writeback can complete after the
server-side copy/clone has run and reinstate stale data over the region
just written by the server, corrupting the file. This is the same class
of corruption as commit d7d2adcd022b ("smb/client: flush dirty data
before punching a hole") and has been seen randomly in generic/363
against Windows Server.
Fix both paths to follow the established ordering: hold the target
mapping's invalidate_lock across the flush and invalidation of the
destination and the server ioctl, and call netfs_wait_for_outstanding_io()
on the target to drain in-flight writes before the ioctl is issued. Only
the target inode's invalidate_lock is required, as the source is merely
flushed and not invalidated; i_rwsem (already held via
lock_two_nondirectories()) is acquired before the invalidate_lock,
matching the VFS lock ordering. Since filemap_invalidate_inode() takes
that same lock internally, replace it with its own unmap/flush/invalidate
steps instead of calling it, and return early on a zero-length copy to
avoid a range underflow. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected c54fc3a4f375663f2361a9cbb2955fb4ef912879 dc71660f11ef2fecc0695a41e49cd496a9d255ab git |
Not specified |
| CNA |
Linux |
Linux |
affected c54fc3a4f375663f2361a9cbb2955fb4ef912879 c9b1194e8ec99d95db25db45edd2fbf690f043ab git |
Not specified |
| CNA |
Linux |
Linux |
affected 358bd5f436d820bb758833050aae065b35d6986c git |
Not specified |
| CNA |
Linux |
Linux |
affected 43801359c8971cc49b4a4db5015fba77fbd09c32 git |
Not specified |
| CNA |
Linux |
Linux |
affected 6.1.68 6.2 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.6.7 6.7 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.7 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.7 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.10 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/dc71660f11ef2fecc0695a41e49cd496a9d255ab |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.