In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone… (CVE-2026-98682)

The vulnerability in the Linux kernel affects the SMB client code paths for server-side copy and clone operations (cifs_file_copychunk_range() and the clone path of cifs_remap_file_range()). These functions do not properly serialize the destination page cache against server-side copy operations, unlike other SMB range operations. Specifically, the destination range invalidation and flushing do not hold the necessary invalidate_lock throughout the operation, and in-flight network filesystem I/O is not drained before issuing the copy/clone ioctl. This can lead to asynchronous writeback completing after the server-side copy/clone, reinstating stale data and corrupting the file. The fix involves holding the target mapping's invalidate_lock across flushing, invalidation, and the server ioctl, and draining outstanding I/O before issuing the ioctl, thus preventing stale data overwrites.

This vulnerability can cause file corruption on the client side when performing server-side copy or clone operations over SMB. The corruption occurs because stale data can overwrite the newly copied data due to improper synchronization of the page cache and outstanding I/O. There is no indication of remote code execution or privilege escalation. The impact is limited to data integrity loss in affected file operations.

A fix is available that properly serializes the destination page cache by holding the invalidate_lock during flush and invalidation steps and draining outstanding I/O before issuing the server-side copy/clone ioctl. Users should apply the official Linux kernel update that addresses this issue. No additional mitigations are indicated by the vendor advisory.