{"id":"CVE-2026-89640","title":"cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix loff_t underflow in cifs_remap_file_range() when len == 0\n\nWith len == 0 (clone to EOF), the effective length is computed as:\n\n    len = src_inode->i_size - o…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4","Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < 7f62817fe049b0f3652518c1ba72631ec1e0a322","Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < b098f5e5858797827666e6cd73033f52fc39b5f6","Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028","Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < b057ca17b656345d04669cb87f2aff9b31d873db","Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < 6c322f5cf7476ded7a9a20f7be72462065a03c68","Linux 4.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T19:24:54.678656Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:50:12.163Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89640","references":[{"url":"https://git.kernel.org/stable/c/f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4"},{"url":"https://git.kernel.org/stable/c/7f62817fe049b0f3652518c1ba72631ec1e0a322"},{"url":"https://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6"},{"url":"https://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028"},{"url":"https://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db"},{"url":"https://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89640.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89640"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532516"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89640"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89640"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89640.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00126,"epssPercentile":0.02274,"scores":{"cna":7.1,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.450Z","slug":"CVE-2026-89640","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix loff_t underflow in cifs_remap_file_range() when len == 0\n\nWith len == 0 (clone to EOF), the effective length is computed as:\n\n    len = src_inode->i_size - off;\n\nIf off > i_size, this is a negative loff_t, corrupting the ByteCount\nin the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range\nin filemap_write_and_wait_range().  The existing off >= i_size check\nfires only after the ioctl has already been sent.\n\nSnapshot i_size_read() once for both the bounds check and the length\ncalculation, eliminating the TOCTOU and 32-bit torn-read risk.  Reject\noff > src_size with -EINVAL.  Treat off == src_size as a no-op,\nconsistent with __generic_remap_file_range_prep().\n\n## Affected\n\n- `Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4`\n- `Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < 7f62817fe049b0f3652518c1ba72631ec1e0a322`\n- `Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < b098f5e5858797827666e6cd73033f52fc39b5f6`\n- `Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028`\n- `Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < b057ca17b656345d04669cb87f2aff9b31d873db`\n- `Linux >= 04b38d601239b4d9be641b412cf4b7456a041c67 < 6c322f5cf7476ded7a9a20f7be72462065a03c68`\n- `Linux 4.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89640.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223268,"id":"CVE-2026-89640","ts":1792180036362,"field":"cvss","old":"5.5","new":"7.1"},{"seq":223267,"id":"CVE-2026-89640","ts":1792180036362,"field":"severity","old":"medium","new":"high"},{"seq":203929,"id":"CVE-2026-89640","ts":1789490226894,"field":"cvss","old":"7.1","new":"5.5"},{"seq":203928,"id":"CVE-2026-89640","ts":1789490226894,"field":"severity","old":"high","new":"medium"},{"seq":197819,"id":"CVE-2026-89640","ts":1789384320533,"field":"cvss","old":"6.3","new":"7.1"},{"seq":197818,"id":"CVE-2026-89640","ts":1789384320533,"field":"severity","old":"medium","new":"high"},{"seq":183721,"id":"CVE-2026-89640","ts":1789356677100,"field":"cvss","old":"7.1","new":"6.3"},{"seq":183720,"id":"CVE-2026-89640","ts":1789356677100,"field":"severity","old":"high","new":"medium"},{"seq":153484,"id":"CVE-2026-89640","ts":1789285350703,"field":"cvss","old":null,"new":"7.1"},{"seq":153483,"id":"CVE-2026-89640","ts":1789285350703,"field":"severity","old":"none","new":"high"},{"seq":147089,"id":"CVE-2026-89640","ts":1789270195120,"field":"cvss","old":null,"new":"6.3"},{"seq":147088,"id":"CVE-2026-89640","ts":1789270195120,"field":"severity","old":"none","new":"medium"},{"seq":108844,"id":"CVE-2026-89640","ts":1789183729220,"field":"cvss","old":null,"new":"6.3"},{"seq":108843,"id":"CVE-2026-89640","ts":1789183729220,"field":"severity","old":"none","new":"medium"}]}