EUVD-2026-76552
GHSA-hwfc-7pp7-m5j3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Local CIFS mount access and low user privileges required; no confidentiality impact; high integrity and availability impact from corrupted SMB ByteCount and inverted write-range.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
With len == 0 (clone to EOF), the effective length is computed as:
len = src_inode->i_size - off;
If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent.
Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep().
AnalysisAI
Integer underflow in the Linux kernel CIFS client's cifs_remap_file_range() corrupts SMB protocol fields and inverts write-range operations when a clone-to-EOF request is made with a source offset exceeding the file's current size. A local user with low privileges and access to a CIFS-mounted filesystem can trigger this by supplying len=0 and an offset beyond i_size in a FICLONERANGE ioctl, sending a malformed FSCTL_DUPLICATE_EXTENTS_TO_FILE request to the SMB server and disrupting filemap_write_and_wait_range() with an inverted range. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target Linux kernel has the cifs module loaded and at least one CIFS/SMB share is mounted, (2) the attacker holds a local user account with read access to a source file on the CIFS mount, (3) the attacker can invoke clone-range ioctls (FICLONERANGE or equivalent) on that file, which may require write access to the destination file depending on kernel configuration, and (4) the attacker supplies a source offset greater than the file's current i_size with len=0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-calibrated: local access and low privileges gate the attack surface, and the C:N metric correctly reflects zero confidentiality exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading the Linux kernel to 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, which include the corrected cifs_remap_file_range() implementation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running kernel versions prior to 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 that have CIFS-mounted filesystems in production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today