In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len ==… (CVE-2026-89640)
A vulnerability in the Linux kernel's CIFS implementation was fixed involving an underflow of a signed offset (loff_t) in the cifs_remap_file_range() function when the length parameter is zero. This underflow occurs when the offset is greater than the source inode size, leading to corruption of the ByteCount in a file system control request and inversion of the range in a file write operation. The fix involves proper bounds checking and eliminating a time-of-check to time-of-use (TOCTOU) race condition by rejecting offsets greater than the source size and treating offsets equal to the source size as no-ops.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-89640 concerns the cifs_remap_file_range() function in the CIFS filesystem code. When the length parameter is zero, indicating a clone to EOF operation, the effective length is calculated as the difference between the source inode size and the offset. If the offset exceeds the inode size, this results in a negative loff_t value causing corruption in the ByteCount field of the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The vulnerability arises because the existing check for offset >= inode size occurs only after the ioctl has been sent, allowing the underflow to occur. The patch snapshots the inode size once to avoid TOCTOU and torn-read issues, rejects offsets greater than the source size with an error, and treats offsets equal to the source size as no-ops, aligning behavior with related remap functions.
Potential Impact
The vulnerability can cause corruption of internal file system control request parameters and inversion of file write ranges during clone operations in CIFS. This could potentially lead to incorrect file data being written or other filesystem inconsistencies. However, no known exploits in the wild have been reported. The impact is limited to systems using the CIFS filesystem with this specific code path.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by improving bounds checking and eliminating race conditions. Users and administrators should apply the official kernel updates that include this patch to remediate the issue. Since this is a kernel-level fix, updating to a patched kernel version is the recommended mitigation.
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len ==… (CVE-2026-89640)
Description
A vulnerability in the Linux kernel's CIFS implementation was fixed involving an underflow of a signed offset (loff_t) in the cifs_remap_file_range() function when the length parameter is zero. This underflow occurs when the offset is greater than the source inode size, leading to corruption of the ByteCount in a file system control request and inversion of the range in a file write operation. The fix involves proper bounds checking and eliminating a time-of-check to time-of-use (TOCTOU) race condition by rejecting offsets greater than the source size and treating offsets equal to the source size as no-ops.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-89640 concerns the cifs_remap_file_range() function in the CIFS filesystem code. When the length parameter is zero, indicating a clone to EOF operation, the effective length is calculated as the difference between the source inode size and the offset. If the offset exceeds the inode size, this results in a negative loff_t value causing corruption in the ByteCount field of the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The vulnerability arises because the existing check for offset >= inode size occurs only after the ioctl has been sent, allowing the underflow to occur. The patch snapshots the inode size once to avoid TOCTOU and torn-read issues, rejects offsets greater than the source size with an error, and treats offsets equal to the source size as no-ops, aligning behavior with related remap functions.
Potential Impact
The vulnerability can cause corruption of internal file system control request parameters and inversion of file write ranges during clone operations in CIFS. This could potentially lead to incorrect file data being written or other filesystem inconsistencies. However, no known exploits in the wild have been reported. The impact is limited to systems using the CIFS filesystem with this specific code path.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by improving bounds checking and eliminating race conditions. Users and administrators should apply the official kernel updates that include this patch to remediate the issue. Since this is a kernel-level fix, updating to a patched kernel version is the recommended mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hwfc-7pp7-m5j3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89640"]
Threat ID: 6aa4a00455bf5e2cf5a8662c
Added to database: 09/12/2026, 00:42:44 UTC
Last enriched: 09/12/2026, 00:57:41 UTC
Last updated: 09/12/2026, 00:57:41 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.