---
id: CVE-2026-98682
title: 'smb: client: drain and invalidate before server-side copy/clone'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: drain and invalidate before server-side copy/clone

  cifs_file_copychunk_range() and the clone (FICLONE) path of
  cifs_remap_file_range() do not serialise th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 <
    dc71660f11ef2fecc0695a41e49cd496a9d255ab
  - >-
    Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 <
    c9b1194e8ec99d95db25db45edd2fbf690f043ab
  - Linux 358bd5f436d820bb758833050aae065b35d6986c
  - Linux 43801359c8971cc49b4a4db5015fba77fbd09c32
  - Linux >= 6.1.68 < 6.2
  - Linux >= 6.6.7 < 6.7
  - Linux 6.7
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:45:47.375Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98682'
references:
  - url: 'https://git.kernel.org/stable/c/dc71660f11ef2fecc0695a41e49cd496a9d255ab'
  - url: 'https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.529Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: drain and invalidate before server-side copy/clone

cifs_file_copychunk_range() and the clone (FICLONE) path of
cifs_remap_file_range() do not serialise the destination page cache
against the server-side copy the way the other server-side range
operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()
and smb3_insert_range()) do.

cifs_file_copychunk_range() invalidates the destination range with
filemap_invalidate_inode(), which takes and drops the mapping's
invalidate_lock internally, so the lock is no longer held when the
copychunk ioctl is issued.  It also never drains in-flight netfs I/O on
the target.  The clone path never takes the invalidate_lock at all (only
i_rwsem), uses a bare truncate_inode_pages_range() and likewise does not
drain outstanding I/O.

As a result an asynchronous destination writeback can complete after the
server-side copy/clone has run and reinstate stale data over the region
just written by the server, corrupting the file.  This is the same class
of corruption as commit d7d2adcd022b ("smb/client: flush dirty data
before punching a hole") and has been seen randomly in generic/363
against Windows Server.

Fix both paths to follow the established ordering: hold the target
mapping's invalidate_lock across the flush and invalidation of the
destination and the server ioctl, and call netfs_wait_for_outstanding_io()
on the target to drain in-flight writes before the ioctl is issued.  Only
the target inode's invalidate_lock is required, as the source is merely
flushed and not invalidated; i_rwsem (already held via
lock_two_nondirectories()) is acquired before the invalidate_lock,
matching the VFS lock ordering.  Since filemap_invalidate_inode() takes
that same lock internally, replace it with its own unmap/flush/invalidate
steps instead of calling it, and return early on a zero-length copy to
avoid a range underflow.

## Affected

- `Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 < dc71660f11ef2fecc0695a41e49cd496a9d255ab`
- `Linux >= c54fc3a4f375663f2361a9cbb2955fb4ef912879 < c9b1194e8ec99d95db25db45edd2fbf690f043ab`
- `Linux 358bd5f436d820bb758833050aae065b35d6986c`
- `Linux 43801359c8971cc49b4a4db5015fba77fbd09c32`
- `Linux >= 6.1.68 < 6.2`
- `Linux >= 6.6.7 < 6.7`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.