{"id":"CVE-2026-98682","kind":"vulnerability","aliases":["CVE-2026-98682"],"related":[],"title":"Linux kernel SMB client: destination cache can corrupt files after server-side copy","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: drain and invalidate before server-side copy/clone\n\ncifs_file_copychunk_range() and the clone (FICLONE) path of\ncifs_remap_file_range() do not serialise the destination page cache\nagainst the server-side copy the way the other server-side range\noperations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()\nand smb3_insert_range()) do.\n\ncifs_file_copychunk_range() invalidates the destination range with\nfilemap_invalidate_inode(), which takes and drops the mapping's\ninvalidate_lock internally, so the lock is no longer held when the\ncopychunk ioctl is issued.  It also never drains in-flight netfs I/O on\nthe target.  The clone path never takes the invalidate_lock at all (only\ni_rwsem), uses a bare truncate_inode_pages_range() and likewise does not\ndrain outstanding I/O.\n\nAs a result an asynchronous destination writeback can complete after the\nserver-side copy/clone has run and reinstate stale data over the region\njust written by the server, corrupting the file.  This is the same class\nof corruption as commit d7d2adcd022b (\"smb/client: flush dirty data\nbefore punching a hole\") and has been seen randomly in generic/363\nagainst Windows Server.\n\nFix both paths to follow the established ordering: hold the target\nmapping's invalidate_lock across the flush and invalidation of the\ndestination and the server ioctl, and call netfs_wait_for_outstanding_io()\non the target to drain in-flight writes before the ioctl is issued.  Only\nthe target inode's invalidate_lock is required, as the source is merely\nflushed and not invalidated; i_rwsem (already held via\nlock_two_nondirectories()) is acquired before the invalidate_lock,\nmatching the VFS lock ordering.  Since filemap_invalidate_inode() takes\nthat same lock internally, replace it with its own unmap/flush/invalidate\nsteps instead of calling it, and return early on a zero-length copy to\navoid a range underflow.","summary":"Linux kernel CIFS/SMB client copy and clone paths do not drain in-flight writeback on the destination file before a server-side copy, so stale cached data can overwrite the copied region. The sources describe file corruption, not a confirmed attacker-controlled read or code execution path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","kernel","linux","runtime","smb","windows-file-server"],"not_affected_if":["local-filesystems-only","no-smb-mounts"],"how_to_check":"- `uname -r` on hosts that mount SMB shares with cifs, and compare against the kernel version that carries the upstream fix\n- `lsmod | grep cifs` to confirm the cifs module is loaded at all\n- unknown whether the sources list specific fixed kernel versions","fix":"- Update the Linux kernel to a release that includes the upstream commit titled \"smb: client: drain and invalidate before server-side copy/clone\"\n- unknown whether the sources name a fixed version","status":"open","published_at":"2026-10-18T16:17:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:14+00:00","updated_at":"2026-10-25T05:19:14+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:19:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit titled \"smb: client: drain and invalidate before server-side copy/clone\"\n- unknown whether the sources name a fixed version","reach":"network","title":"Linux kernel SMB client: destination cache can corrupt files after server-side copy","impact":"medium","summary":"Linux kernel CIFS/SMB client copy and clone paths do not drain in-flight writeback on the destination file before a server-side copy, so stale cached data can overwrite the copied region. The sources describe file corruption, not a confirmed attacker-controlled read or code execution path.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","smb","cifs","windows-file-server"],"confidence":0.5,"needs_auth":"unknown","worst_case":"file contents on an SMB share silently corrupted by stale cached data","analyst_note":"Find the upstream kernel commit and the fixed stable kernel versions, and confirm whether an attacker can trigger the race or it is only a reliability bug.","how_to_check":"- `uname -r` on hosts that mount SMB shares with cifs, and compare against the kernel version that carries the upstream fix\n- `lsmod | grep cifs` to confirm the cifs module is loaded at all\n- unknown whether the sources list specific fixed kernel versions","needs_analyst":true,"not_affected_if":["no-smb-mounts","local-filesystems-only"],"who_is_affected":"Systems that mount SMB/CIFS shares with the Linux cifs client and use server-side copy or reflink clone (copy_file_range or FICLONE) on files on those mounts are the exposed ones. Hosts that do not mount SMB shares, or that only use local filesystems, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":3909,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98682':17A,20A 'acquir':359C 'across':299C 'alreadi':352C 'also':186C 'asynchron':228C 'attack':73B 'attacker-control':72B 'avoid':399C 'bare':212C 'cach':6A,57B,120C 'call':312C,387C 'cif':21B,100C,110C,150C 'cifs/smb':32B 'class':260C 'client':4A,33B,91C 'clone':36B,106C,198C 'code':77B 'collaps':143C 'commit':264C 'complet':232C 'confirm':71B 'control':74B 'copi':14A,34B,54B,62B,126C,397C 'copy/clone':99C,238C 'copychunk':102C,152C,181C 'corrupt':8A,68B,253C,262C 'cve':15A,18A 'd7d2adcd022b':265C 'data':58B,244C,269C 'describ':66B 'destin':5A,47B,118C,156C,229C,306C 'dirti':268C 'drain':40B,92C,188C,221C,322C 'drop':165C 'earli':391C 'establish':290C 'execut':78B 'ficlon':107C 'file':9A,28B,48B,67B,101C,112C,151C,255C 'filemap':159C,370C 'fix':284C 'flight':43B,191C,325C 'flush':267C,301C,346C 'follow':85C,288C 'generic/363':280C 'held':178C,353C 'hold':292C 'hole':141C,273C 'i/o':193C,223C 'in-flight':41B,189C,323C 'inod':161C,214C,335C,372C 'insert':147C 'instead':385C 'intern':171C,377C 'invalid':94C,154C,160C,169C,203C,297C,303C,337C,349C,362C,371C 'io':317C 'ioctl':182C,310C,329C 'issu':184C,331C 'kernel':2A,22B,31B,83C 'length':396C 'likewis':218C 'linux':1A,23B,30B,82C 'lock':170C,174C,204C,298C,338C,355C,363C,367C,376C 'longer':177C 'map':167C,295C 'match':364C 'mere':345C 'netf':192C,313C 'never':187C,200C 'nondirectori':357C 'oper':135C 'order':291C,368C 'outstand':222C,316C 'overwrit':60B 'page':119C,215C 'path':37B,79B,108C,199C,286C 'punch':140C,271C 'random':278C 'rang':103C,113C,134C,138C,144C,148C,153C,157C,216C,401C 'read':75B 'region':63B,247C 'reinstat':242C 'remap':111C 'replac':378C 'requir':340C 'resolv':89C 'result':226C 'return':390C 'run':240C 'runtim':24B 'rwsem':209C,351C 'seen':277C 'serialis':116C 'server':12A,29B,52B,97C,124C,132C,236C,252C,283C,309C 'server-sid':11A,51B,96C,123C,131C,235C 'side':13A,53B,98C,125C,133C,237C 'sinc':369C 'smb':3A,25B,90C 'smb/client':266C 'smb3':136C,139C,142C,146C 'sourc':65B,343C 'stale':56B,243C 'step':384C 'take':163C,201C,373C 'target':196C,294C,320C,334C 'truncat':213C 'two':356C 'underflow':402C 'unmap/flush/invalidate':383C 'use':210C 'vfs':366C 'via':354C 'vulner':86C 'wait':314C 'way':128C 'window':27B,282C 'windows-file-serv':26B 'write':326C 'writeback':44B,230C 'written':249C 'zero':137C,395C 'zero-length':394C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount SMB/CIFS shares with the Linux cifs client and use server-side copy or reflink clone (copy_file_range or FICLONE) on files on those mounts are the exposed ones. Hosts that do not mount SMB shares, or that only use local filesystems, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98682","severity":null,"published_at":"2026-10-18T16:17:21+00:00","modified_at":"2026-10-19T10:19:32+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}