{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98682 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98682 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98682 and fix it if it is affected.\n\nWhat it is: CVE-2026-98682 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98682 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98682/ (Markdown: https://insights.sbomify.com/CVE-2026-98682/index.md)","id":"CVE-2026-98682","markdown":"https://insights.sbomify.com/CVE-2026-98682/index.md","name":"CVE-2026-98682","record":{"aliases":["BELL-CVE-2026-98682","DEBIAN-CVE-2026-98682","GHSA-78hr-gpp6-3qpr","UBUNTU-CVE-2026-98682"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel SMB client","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel SMB client allows local attackers to corrupt files by exploiting unsynchronized page cache invalidation during server-side copy operations.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: drain and invalidate before server-side copy/clone\n\ncifs_file_copychunk_range() and the clone (FICLONE) path of\ncifs_remap_file_range() do not serialise the destination page cache\nagainst the server-side copy the way the other server-side range\noperations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()\nand smb3_insert_range()) do.\n\ncifs_file_copychunk_range() invalidates the destination range with\nfilemap_invalidate_inode(), which takes and drops the mapping's\ninvalidate_lock internally, so the lock is no longer held when the\ncopychunk ioctl is issued.  It also never drains in-flight netfs I/O on\nthe target.  The clone path never takes the invalidate_lock at all (only\ni_rwsem), uses a bare truncate_inode_pages_range() and likewise does not\ndrain outstanding I/O.\n\nAs a result an asynchronous destination writeback can complete after the\nserver-side copy/clone has run and reinstate stale data over the region\njust written by the server, corrupting the file.  This is the same class\nof corruption as commit d7d2adcd022b (\"smb/client: flush dirty data\nbefore punching a hole\") and has been seen randomly in generic/363\nagainst Windows Server.\n\nFix both paths to follow the established ordering: hold the target\nmapping's invalidate_lock across the flush and invalidation of the\ndestination and the server ioctl, and call netfs_wait_for_outstanding_io()\non the target to drain in-flight writes before the ioctl is issued.  Only\nthe target inode's invalidate_lock is required, as the source is merely\nflushed and not invalidated; i_rwsem (already held via\nlock_two_nondirectories()) is acquired before the invalidate_lock,\nmatching the VFS lock ordering.  Since filemap_invalidate_inode() takes\nthat same lock internally, replace it with its own unmap/flush/invalidate\nsteps instead of calling it, and return early on a zero-length copy to\navoid a range underflow.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"smb: client: drain and invalidate before server-side copy/clone","id":"CVE-2026-98682","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"smb: client: flush dirty data before zeroing a range","id":"CVE-2026-98683"},"packages":[],"prev":{"headline":"smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races","id":"CVE-2026-98681"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel SMB client allows local attackers to corrupt files by exploiting unsynchronized page cache invalidation during server-side copy operations.","url":"https://insights.sbomify.com/CVE-2026-98682/"}