UBUNTU-CVE-2026-98682: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange() and the clone (FICLONE) path of cifsremapfilerange() do not serialise the destination page cache against the server-side copy the way the other server-side range operations (smb3zerorange(), smb3punchhole(), smb3collapserange() and smb3insertrange()) do. cifsfilecopychunkrange() invalidates the destination range with filemapinvalidateinode(), which takes and drops the mapping's invalidatelock internally, so the lock is no longer held when the copychunk ioctl is issued. It also never drains in-flight netfs I/O on the target. The clone path never takes the invalidatelock at all (only irwsem), uses a bare truncateinodepagesrange() and likewise does not drain outstanding I/O. As a result an asynchronous destination writeback can complete after the server-side copy/clone has run and reinstate stale data over the region just written by the server, corrupting the file. This is the same class of corruption as commit d7d2adcd022b ("smb/client: flush dirty data before punching a hole") and has been seen randomly in generic/363 against Windows Server. Fix both paths to follow the established ordering: hold the target mapping's invalidatelock across the flush and invalidation of the destination and the server ioctl, and call netfswaitforoutstandingio() on the target to drain in-flight writes before the ioctl is issued. Only the target inode's invalidatelock is required, as the source is merely flushed and not invalidated; irwsem (already held via locktwonondirectories()) is acquired before the invalidatelock, matching the VFS lock ordering. Since filemapinvalidateinode() takes that same lock internally, replace it with its own unmap/flush/invalidate steps instead of calling it, and return early on a zero-length copy to avoid a range underflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
In both cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range(), acquire the target mapping's invalidate_lock before flushing and invalidating the destination, keep it held through the server-side copy/clone ioctl, and call netfs_wait_for_outstanding_io() on the target before issuing the ioctl. Replace filemap_invalidate_inode() with explicit unmap/flush/invalidate steps, and return early for zero-length copies to avoid range underflow.
Event History
Frequently Asked Questions
Which systems are most relevant to this issue?
The listed affected software consists of Ubuntu kernel packages for riscv, realtime, Azure, GCP, Azure FDE, GKE, HWE Edge, and GKEop. Exposure is relevant where the Linux SMB/CIFS client performs server-side copy or clone operations.
What conditions are needed for corruption to occur?
A server-side copy through cifs_file_copychunk_range() or a clone through the FICLONE path of cifs_remap_file_range() must target a file range with asynchronous destination writeback or other in-flight netfs I/O. The stale writeback can then complete after the server-side operation and overwrite the newly written range.
What is the practical impact?
The target file can be corrupted when stale cached data is reinstated over data written by the SMB server. The supplied severity is low, with local access and low privileges indicated in the vector.