SB20261022278 - Race condition in Linux kernel smb client

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98682)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt file data on an SMB share.

The vulnerability exists due to a race condition in the Linux kernel SMB client's cifs_file_copychunk_range() function and the clone path of cifs_remap_file_range() when performing server-side copy or clone operations with outstanding destination writes. A local user can initiate these operations while asynchronous destination writeback is pending to cause stale data to overwrite the newly copied or cloned data, corrupting the destination file.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab
• https://git.kernel.org/stable/c/dc71660f11ef2fecc0695a41e49cd496a9d255ab