{
  "cveId": "CVE-2026-98682",
  "url": "https://patchblox.com/security/cve/CVE-2026-98682",
  "summary": "CVE-2026-98682 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98682 (version 7.2.10-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "smb: client: drain and invalidate before server-side copy/clone",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  smb: client: drain and invalidate before server-side copy/clone  cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range() do not serialise the destination page cache against the server-side copy the way the other server-side range operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range() and smb3_insert_range()) do.  cifs_file_copychunk_range() invalidates the destination range with filemap_invalidate_inode(), which takes and drops the mapping\u0027s invalidate_lock internally, so the lock is no longer held when the copychunk ioctl is issued.  It also never drains in-flight netfs I/O on the target.  The clone path never takes the invalidate_lock at all (only i_rwsem), uses a bare truncate_inode_pages_range() and likewise does not drain outstanding I/O.  As a result an asynchronous destination writeback can complete after the server-side copy/clone has run and reinstate stale data over the region just written by the server, corrupting the file.  This is the same class of corruption as commit d7d2adcd022b (\u0022smb/client: flush dirty data before punching a hole\u0022) and has been seen randomly in generic/363 against Windows Server.  Fix both paths to follow the established ordering: hold the target mapping\u0027s invalidate_lock across the flush and invalidation of the destination and the server ioctl, and call netfs_wait_for_outstanding_io() on the target to drain in-flight writes before the ioctl is issued.  Only the target inode\u0027s invalidate_lock is required, as the source is merely flushed and not invalidated; i_rwsem (already held via lock_two_nondirectories()) is acquired before the invalidate_lock, matching the VFS lock ordering.  Since filemap_invalidate_inode() takes that same lock internally, replace it with its own unmap/flush/invalidate steps instead of calling it, and return early on a zero-length copy to avoid a range underflow.",
  "published": "2026-10-18T16:17:21Z",
  "severity": "",
  "epss": 0.00166,
  "epssPercentile": 0.05864,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98682",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98682",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98682",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}