CVE-2026-89640: Linux Kernel Race Condition Vulnerability

CVE-2026-89640 Overview

CVE-2026-89640 is an integer underflow vulnerability in the Linux kernel's Common Internet File System (CIFS) client. The flaw resides in cifs_remap_file_range() when the caller specifies len == 0 to request a clone-to-EOF operation. If the source offset exceeds the source inode size, the computed length becomes a negative loff_t, corrupting the ByteCount field in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range passed to filemap_write_and_wait_range(). A local authenticated user with access to a CIFS mount can trigger the condition to cause integrity and availability impact on the mounted filesystem.

Critical Impact
A local user can corrupt CIFS remap operations and induce kernel-side range inversion, leading to filesystem integrity loss or denial of service on affected Linux systems.

Affected Products

Linux kernel CIFS client (upstream, prior to the referenced stable fixes)
Distributions shipping vulnerable stable kernel branches that mount SMB/CIFS shares
Systems exposing CIFS mounts to unprivileged local users via ioctl-capable interfaces

Discovery Timeline

2026-09-11 - CVE-2026-89640 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89640

Vulnerability Analysis

The vulnerability affects the CIFS clone/remap path used to service FICLONE and FICLONERANGE requests over SMB. When a user invokes remap with len == 0, the kernel interprets this as a clone-to-end-of-file. The kernel computes the effective length using len = src_inode->i_size - off;. When off is greater than i_size, the subtraction underflows into a negative loff_t value.

That negative length propagates into two dangerous places. First, it corrupts the ByteCount field in the outbound FSCTL_DUPLICATE_EXTENTS_TO_FILE request sent to the SMB server. Second, it inverts the range supplied to filemap_write_and_wait_range(), which can drive incorrect writeback and cache flush behavior. The existing off >= i_size guard executes only after the ioctl has already been dispatched, so it does not prevent the underflow.

Root Cause

The root cause is an unchecked signed subtraction combined with a time-of-check to time-of-use (TOCTOU) window on i_size_read(). The i_size value was read multiple times without snapshotting, allowing 32-bit torn reads and race conditions between the bounds check and the length computation. Fundamentally this is an integer underflow [CWE-191] compounded by a TOCTOU race [CWE-367].

Attack Vector

Exploitation requires local access with permission to issue clone-range ioctls against a file on a mounted CIFS share. An attacker crafts an ioctl invocation specifying len = 0 and an off value greater than the source file size. The malformed request reaches the SMB server with corrupted byte counts and triggers inverted range handling in the kernel page cache path, producing filesystem integrity impact and potential denial of service.

No public proof-of-concept is currently available. Technical detail can be reviewed in the upstream stable patches, including Kernel Security Fix b057ca17 and Kernel Patch for Stability 6c322f5c.

Detection Methods for CVE-2026-89640

Indicators of Compromise

Kernel log entries or SMB server logs showing malformed FSCTL_DUPLICATE_EXTENTS_TO_FILE requests with implausible ByteCount values.
Unexpected -EINVAL failures returned from ioctl(FICLONERANGE) calls against CIFS-mounted files following the applied patch.
Anomalous writeback errors or cache flush failures on files residing on CIFS mounts.

Detection Strategies

Audit local processes issuing FICLONE or FICLONERANGE ioctls against CIFS mount points, particularly with len = 0 and large offset values.
Correlate SMB protocol telemetry from file servers with client-side ioctl activity to identify malformed duplicate-extents requests.
Monitor kernel dmesg output for CIFS subsystem warnings related to remap or filemap range operations.

Monitoring Recommendations

Enable Linux audit rules on ioctl syscalls targeting files on CIFS mounts and forward events to a centralized log platform.
Track kernel version inventory across the fleet to identify hosts running vulnerable stable branches.
Alert on repeated CIFS ioctl failures from a single non-root user account, which may indicate exploitation attempts.

How to Mitigate CVE-2026-89640

Immediate Actions Required

Apply the upstream stable kernel patches listed in the references and reboot affected hosts.
Restrict local shell access on systems that mount CIFS/SMB shares to trusted users only.
Where feasible, unmount CIFS shares on multi-user systems until patched kernels are deployed.

Patch Information

The fix snapshots i_size_read() once for both the bounds check and length calculation, eliminating the TOCTOU and 32-bit torn-read risk. It rejects off > src_size with -EINVAL and treats off == src_size as a no-op, consistent with __generic_remap_file_range_prep(). Patches are available across multiple stable branches, including Kernel Patch for Performance 7f62817f, Kernel Bug Fix Update b098f5e5, Kernel Memory Management Patch c2a0dcb5, and Kernel Fix for System Error f3d1ae1e.

Workarounds

Disable clone-range ioctl usage in application workflows that operate on CIFS-mounted files until patches are applied.
Enforce least-privilege access controls on CIFS mount points using standard POSIX permissions and mount options such as noexec and nosuid.
Use mandatory access control frameworks such as SELinux or AppArmor to constrain processes that can issue ioctls on network filesystems.

bash

# Configuration example: verify kernel version and check for CIFS mounts
uname -r
mount -t cifs
# Apply distribution kernel updates, for example on Debian/Ubuntu:
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-[^-]*-//')
sudo reboot