- 7.1HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep().
Timeline
ID reserved
By Linux
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 98% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < 2c6eede83b3de1268db92c7e49741761c954aa26
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < ce813e5eebf46851e872ce59bdc34dc5dd4e29a4
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < 7f62817fe049b0f3652518c1ba72631ec1e0a322
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < b098f5e5858797827666e6cd73033f52fc39b5f6
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < b057ca17b656345d04669cb87f2aff9b31d873db
- affected 04b38d601239b4d9be641b412cf4b7456a041c67 – < 6c322f5cf7476ded7a9a20f7be72462065a03c68
- affected 4.5
- unaffected < 4.5
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/2c6eede83b3de1268db92c7e49741761c954aa26 (opens in a new tab)
- https://git.kernel.org/stable/c/ce813e5eebf46851e872ce59bdc34dc5dd4e29a4 (opens in a new tab)
- https://git.kernel.org/stable/c/f3d1ae1e6bc4a9f559185b6e7bd2b6375ec2fdd4 (opens in a new tab)
- https://git.kernel.org/stable/c/7f62817fe049b0f3652518c1ba72631ec1e0a322 (opens in a new tab)
- https://git.kernel.org/stable/c/b098f5e5858797827666e6cd73033f52fc39b5f6 (opens in a new tab)
- https://git.kernel.org/stable/c/c2a0dcb5a7a1516aa6eb6d5cedca6a8e76527028 (opens in a new tab)
- https://git.kernel.org/stable/c/b057ca17b656345d04669cb87f2aff9b31d873db (opens in a new tab)
- https://git.kernel.org/stable/c/6c322f5cf7476ded7a9a20f7be72462065a03c68 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76552 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89640)Record last updated .