Executive brief
A flaw in the Linux kernel's CIFS file system implementation allows an integer underflow when cloning file ranges with a zero-length parameter. An attacker with local access could exploit this to corrupt kernel memory structures and potentially achieve denial of service or privilege escalation on systems using CIFS mounts.
Technical details
The vulnerability is an integer underflow in the cifs_remap_file_range() function in fs/smb/client/cifsfs.c. When a user requests a clone operation with len == 0 (clone to end-of-file), the kernel computes the effective length as `len = src_inode->i_size - off`. If the file offset (off) is greater than the file size, this results in a negative loff_t value, corrupting the ByteCount field in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range passed to filemap_write_and_wait_range(). The vulnerability exists due to a time-of-check-time-of-use (TOCTOU) race and improper bounds checking. The fix snapshots the file size once and rejects offsets greater than the source file size with -EINVAL before any IOCTL is sent. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions (patched in stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-09-14: patched