UBUNTU-CVE-2026-89640: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = srcinode->isize - off; If off > isize, this is a negative lofft, corrupting the ByteCount in the FSCTLDUPLICATEEXTENTSTOFILE request and inverting the range in filemapwriteandwaitrange(). The existing off >= isize check fires only after the ioctl has already been sent. Snapshot isizeread() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > srcsize with -EINVAL. Treat off == srcsize as a no-op, consistent with genericremapfilerangeprep().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cifs_remap_file_range(), snapshot i_size_read() once, reject off > src_size with -EINVAL before sending the ioctl, calculate len from the snapshot when len == 0, and treat off == src_size as a no-op.