CVE-2026-89640

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-89640

Key Details

CVE	CVE-2026-89640
CVSS Score / Version	7.1 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

With len == 0 (clone to EOF), the effective length is computed as:

len = src_inode->i_size - off;

If off > i_size, this is a negative loff_t, corrupting the ByteCount

in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range

in filemap_write_and_wait_range(). The existing off >= i_size check

fires only after the ioctl has already been sent.

Snapshot i_size_read() once for both the bounds check and the length

calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject

off > src_size with -EINVAL. Treat off == src_size as a no-op,

consistent with __generic_remap_file_range_prep(). (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89640
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89640

Source

Reference

NVD

CVE